6

If a user in AWS is having AdministratorAccess policy attached, he has full AWS access for that account. But with permission boundaries attached to that user his access can be confined. For example say the user has permission boundaries set to AmazonDynamoDBFullAccess, then the full access is just confined to DynamoDB.

What is real benefit of above approach, one could have just removed the AdministratorAccess policy and attached AmazonDynamoDBFullAccess to the user to achieve the same restrictions/permissions.

Is there anything more to understand?

1

1 Answer 1

5

That is not not purpose of IAM Permission Boundaries, nor is it the way it operates.

From Permissions boundaries for IAM entities - AWS Identity and Access Management:

AWS supports permissions boundaries for IAM entities (users or roles). A permissions boundary is an advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity. An entity's permissions boundary allows it to perform only the actions that are allowed by both its identity-based policies and its permissions boundaries.

To explain via an example, let's say that a developer needs permission to create an IAM Role in their software development duties. This can be a very dangerous permission to assign because they could create a Role that has full Admin permissions, thereby granting themselves even more permission that desired.

To limit their abilities, a permission boundary could be added to the developer such that they are only able to create an IAM Role if the role they define is attached to a permission boundary that limits the permissions of the Role (eg so it can only be used to access S3 and DynamoDB, but not other services). It can be a little confusing, but think of it as a set of rules that must be attached to any permissions they give, so that they can't grant full permissions. It's a way to grant them permissions, but limits what permissions they can on-grant to other entities.

This concept is totally separate to assigning IAM managed policies that you mention in your question. In most circumstances, assigning an IAM managed policy is perfectly sufficient. Permissions boundaries only really apply when somebody has permission to create new IAM entities.

5
  • for the detailed explanation +1. So if a user is able to create new IAM roles and has his boundaries set to AmazonDynamoDBFullAccess. The new users created would also have there permission restricted to AmazonDynamoDBFullAccess i.e DynamoDB. That's what I understand?
    – user14305942
    Oct 5, 2020 at 3:35
  • 1
    Close, but no. AmazonDynamoDBFullAccess is a "managed policy". A Permissions Boundary is also a policy, but is defined separately. An IAM User can be given permission to create an IAM Role or another IAM User, but only if they attach the Permission Boundary, which limits the permissions that they assign. It's a bit like Learner plates on a car -- they have permissions, but some rules override those permissions to limit what they can do. Oct 5, 2020 at 11:20
  • quite interesting to know -> An IAM User can be given permission to create an IAM Role or another IAM User, but only if they attach the Permission Boundary. So the creator has to restrict the new user to the boundaries the creator himself is bounded to.
    – user14305942
    Oct 5, 2020 at 11:35
  • Not necessarily. An IAM User can be required to attach a Permissions Boundary that restricts the permissions they can "pass on", but I think (?) they can actually have more permissions themselves. Please consult the documentation and play around with it, since it can be quite a confusing concept (and I might be wrong!). Oct 5, 2020 at 11:38
  • Worth noting that AWS' own docs advise not to apply boundaries to users, but to the policies they create.
    – Dan1701
    Oct 1, 2022 at 2:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.