5 ms·

Q: do you apply policy on roles, resources, or both? How do you maintain mental sanity? We use 1 base policy + 1 policy/role, and so for each role it's easy to

by ecesena 10y ago

Q: do you apply policy on roles, resources, or both? How do you maintain mental sanity? We use 1 base policy + 1 policy/role, and so for each role it's easy to see what are its permissions. We have no policy on resources, so it's hard, e.g., given a bucket to know who has access to it. We're building tooling for that. edit: grammar/typos

colemorrison 10y ago
It's honestly going to depend. In some cases you don't really have a choice. For example if you want to limit an S3 bucket to an IAM group, since S3/Resource Policies don't support IAM groups ARNs in the principal, the only solution is to apply the permissions around access to that S3 bucket to the IAM group (as opposed to the bucket). As for which direction, this is going to be a bit of preference and need. Do you want permissions to begin at the user or at the resource? For scenarios, like a bucket controlling access to non-aws users, it makes sense to have it on the resource. For others, like delegating bucket access to certain EC2 instances, it makes more sense to keep it on the role user. The fuzzy lines of gray are only exaggerated by the fact that the docs love doing stuff like: "These two policies are equivalent!" And showing examples that accomplish both. Tl;dr, (a) pick the permission direction that makes sense (b) set a standard for your team and infrastructure and stick with it (c) try to not use NotVersions of actions
- ecesena 10y ago
  These recommendations are great, and for us the direction is definitely everything on roles. I was curious to see what others do concretely.
  - devonbleak 10y ago
    We have both out of necessity. IAM policies on roles/users/groups are a given, but here are some concrete examples of what we're using resource policies for: - Granting cross-account access to resources without requiring an explicit sts:AssumeRole on the other side (in some cases for things like CloudTrail and billing reports this is the only option) - Enforcing SSE on S3 buckets (implemented as a DENY in the bucket policy with conditions to check for missing SSE headers)
joshpadnick 10y ago
I work on multiple AWS installations and we use the approach you describe of only defining IAM Policies and avoiding resource-based policies where possible. The one exception is KMS Keys, which require a KMS Key Policy. That being said, I've found IAM's power impressive but ultimately complex. If you're really serious about isolating users from certain resources, separate AWS accounts for each environment may well be the best way to do this. This way, you can grant "admin" access to users in your "stage" AWS account, they get all the permissions they need to do their work, and have no permissions to the more sensitive "prod" account.
- colemorrison 10y ago
  This is good stuff right here. Separate accounts can do tons. Also helps prevent stuff like dealing with VPC collision overhead.
  - availabilly 10y ago
    One account per service per region per deployment stage (e.g. dev, test, production) is the best practice. How you define "service" is up to you, but I usually divide them by trust/dependency footprints. This significantly reduces the risk that an account-level problem or throttle will disrupt your entire business. Fortunately, AWS finally seems to be getting serious about building management tools for multiple accounts. AWS Organizations is way better than the old consolidated billing stuff.
    - joseph 10y ago
      Who calls that a best practice? If you're a very small company, that might be fine. With thousands of employees and tens or hundreds of applications, you'll run into serious problems if you want to use e.g. VPC peering for shared services. You'll also run into major cost issues if for example you have per-VPC or per-account commercial appliances.
      - schlarpc 10y ago
cjhanks 10y ago
cjhanks' best IAM practices (opinions). 1. All IAM policies/roles and InstanceProfile's should be managed in CloudFormation, no exception. 2. Policies should not be inlined into the IAM role policy document, rather they should be attached (excepting item 3 and 4). 3. IAM roles which are used for signing S3/CloudFront/... requests which are subsequently made public should should have all policies inlined AND the explicit resource should be defined. 4. IAM roles granting access to an external (non-AWS service) principal should generally inline all statements unless the relationship to the principal can be considered secure. 5. Policies should have multiple statements, one statement per AWS service. 6. Most non-administrative policies dealing with persistent storage (DynamoDB/S3) should be constrained to a limited number of resources. 7. Glob-Star is not permitted for any `Action` statement (ie: no `s3:*`). 8. Absolutely no AWS_ACCESS_KEY's are permitted on EC2 instances.
- alexbanks 10y ago
  re 8: in favor of ec2 role credentials via the metadata service?
  - colemorrison 10y ago
    Without even having to dive into userdata or metadata, just (a) create the role for the ec2; (b) attach the trust and permission policies; (c) create an "instance profile"; (d) attach the instance profile to your target instances. If via console, that gets done behind the scenes when attaching the role. But ya roles use the security token service behind the scenes which allow for temp creds vs. storing sensitive stuffs on the instances.
  - cjhanks 10y ago
    Yes.
jfroma 10y ago
We use an IAM Role for each type/role of vm and per environment/region. I am using more and more inline-policies because in most cases is hard to reuse a managed policies. Also, there is a very low limit for managed policies within a Role: 10. How do we maintain mental sanity? We define all our infrastructure on code (terraform) and we have found the right abstraction in the tool: modules. One module output is used as input on another module. Let's say you have a module to create and configure a bucket exporting the arn of the bucket, then another module to create the autoscaling-group along with its security groups, IAM Role and Policy. All changes are made through pull-requests and reviewed. If you want to know who has access to a resource you read the dsl. I havent seen any tool to query aws api that way. It might be complex to build because policies can have all sort of wildcards.
- colemorrison 10y ago
  Oh wow. That's an interesting case for inline policies. Now that I think about it, yes there's plenty of cases for reusable ones, and there seem to be just as many cases where a policy is unique to exactly that one service/situation.

by ecesena 10y ago

colemorrison 10y ago

It's honestly going to depend. In some cases you don't really have a choice. For example if you want to limit an S3 bucket to an IAM group, since S3/Resource Policies don't support IAM groups ARNs in the principal, the only solution is to apply the permissions around access to that S3 bucket to the IAM group (as opposed to the bucket). As for which direction, this is going to be a bit of preference and need. Do you want permissions to begin at the user or at the resource? For scenarios, like a bucket controlling access to non-aws users, it makes sense to have it on the resource. For others, like delegating bucket access to certain EC2 instances, it makes more sense to keep it on the role user. The fuzzy lines of gray are only exaggerated by the fact that the docs love doing stuff like: "These two policies are equivalent!" And showing examples that accomplish both. Tl;dr, (a) pick the permission direction that makes sense (b) set a standard for your team and infrastructure and stick with it (c) try to not use NotVersions of actions

ecesena 10y ago
These recommendations are great, and for us the direction is definitely everything on roles. I was curious to see what others do concretely.
- devonbleak 10y ago
  We have both out of necessity. IAM policies on roles/users/groups are a given, but here are some concrete examples of what we're using resource policies for: - Granting cross-account access to resources without requiring an explicit sts:AssumeRole on the other side (in some cases for things like CloudTrail and billing reports this is the only option) - Enforcing SSE on S3 buckets (implemented as a DENY in the bucket policy with conditions to check for missing SSE headers)

joshpadnick 10y ago

I work on multiple AWS installations and we use the approach you describe of only defining IAM Policies and avoiding resource-based policies where possible. The one exception is KMS Keys, which require a KMS Key Policy. That being said, I've found IAM's power impressive but ultimately complex. If you're really serious about isolating users from certain resources, separate AWS accounts for each environment may well be the best way to do this. This way, you can grant "admin" access to users in your "stage" AWS account, they get all the permissions they need to do their work, and have no permissions to the more sensitive "prod" account.

colemorrison 10y ago
This is good stuff right here. Separate accounts can do tons. Also helps prevent stuff like dealing with VPC collision overhead.
- availabilly 10y ago
  One account per service per region per deployment stage (e.g. dev, test, production) is the best practice. How you define "service" is up to you, but I usually divide them by trust/dependency footprints. This significantly reduces the risk that an account-level problem or throttle will disrupt your entire business. Fortunately, AWS finally seems to be getting serious about building management tools for multiple accounts. AWS Organizations is way better than the old consolidated billing stuff.
  - joseph 10y ago
    Who calls that a best practice? If you're a very small company, that might be fine. With thousands of employees and tens or hundreds of applications, you'll run into serious problems if you want to use e.g. VPC peering for shared services. You'll also run into major cost issues if for example you have per-VPC or per-account commercial appliances.
    - schlarpc 10y ago

cjhanks 10y ago

cjhanks' best IAM practices (opinions). 1. All IAM policies/roles and InstanceProfile's should be managed in CloudFormation, no exception. 2. Policies should not be inlined into the IAM role policy document, rather they should be attached (excepting item 3 and 4). 3. IAM roles which are used for signing S3/CloudFront/... requests which are subsequently made public should should have all policies inlined AND the explicit resource should be defined. 4. IAM roles granting access to an external (non-AWS service) principal should generally inline all statements unless the relationship to the principal can be considered secure. 5. Policies should have multiple statements, one statement per AWS service. 6. Most non-administrative policies dealing with persistent storage (DynamoDB/S3) should be constrained to a limited number of resources. 7. Glob-Star is not permitted for any `Action` statement (ie: no `s3:*`). 8. Absolutely no AWS_ACCESS_KEY's are permitted on EC2 instances.

alexbanks 10y ago
re 8: in favor of ec2 role credentials via the metadata service?
- colemorrison 10y ago
  Without even having to dive into userdata or metadata, just (a) create the role for the ec2; (b) attach the trust and permission policies; (c) create an "instance profile"; (d) attach the instance profile to your target instances. If via console, that gets done behind the scenes when attaching the role. But ya roles use the security token service behind the scenes which allow for temp creds vs. storing sensitive stuffs on the instances.
- cjhanks 10y ago
  Yes.

jfroma 10y ago

We use an IAM Role for each type/role of vm and per environment/region. I am using more and more inline-policies because in most cases is hard to reuse a managed policies. Also, there is a very low limit for managed policies within a Role: 10. How do we maintain mental sanity? We define all our infrastructure on code (terraform) and we have found the right abstraction in the tool: modules. One module output is used as input on another module. Let's say you have a module to create and configure a bucket exporting the arn of the bucket, then another module to create the autoscaling-group along with its security groups, IAM Role and Policy. All changes are made through pull-requests and reviewed. If you want to know who has access to a resource you read the dsl. I havent seen any tool to query aws api that way. It might be complex to build because policies can have all sort of wildcards.

colemorrison 10y ago
Oh wow. That's an interesting case for inline policies. Now that I think about it, yes there's plenty of cases for reusable ones, and there seem to be just as many cases where a policy is unique to exactly that one service/situation.