I am currently still learning IAM role. As an example, I was able to create EC2 type role and attach the S3 Full Access Control policy. In that case, my EC2 instances can access S3 once the role is attached. Fairly easy to understand.
What is a use case if we select S3 as the type of trusted entity? From my understanding, the access to S3 is usually controlled by the policy. How would S3 service as trusted entity assume the role and what kind of policies could be attached to this role? Just wondering if someone could give me a use case for this. Thanks.
When you add a trusted entity to an IAM role that service is granted the ability to assume the IAM role.
For S3 an example of when this needs to happen is when you want to enable replication, you grant the S3 service the ability to retrieve items from a bucket and put them in another bucket.
For more information on this specific use case take a look at the Setting up permissions for replication page.
Related
I have all my user permission needs covered using IAM, therefore I keep my bucket policy sections completely empty.
I was wondering if this is a good practice and if it raises any potential issues from any perspective.
Perhaps there is some configuration that is good to set as default?
Just double checking.
Typically:
When you want to grant 'public' access to an Amazon S3 bucket, use a Bucket Policy
When you want to grant access to specific IAM Users, attach an IAM policy to the IAM Users or IAM Groups
It sounds like your needs are satisfied via IAM policies, so that's perfectly good (and actually preferable!).
I am looking to add a user in AWS. I have a group with supportUser policy.
The thing is, he can create users and change passwords.
With supportUser policy, he is not able to view any payment information, billing or anything regarding the account.
I am looking for a policy that would only allow him to create a EC2 container, S3 storage and a database. Nothing more. Is there a way to achieve this?
AWS gives you options to create your own fine-grained policies or you can simply use managed policies. Managed policies provide a gentler introduction because AWS has provided curated policies for you. Managed policies are also updated periodically to incorporate new function or new services, as relevant to each specific managed policy.
See AWS managed policies for job functions or, more generally, AWS managed policies.
The simplest managed policies for your use case are probably:
AmazonEC2FullAccess
AmazonRDSFullAccess
AmazonS3FullAccess
Important note: each of these policies grants the user significant permissions over all EC2, RDS, and S3 resources so you may find them too permissive for your use case.
If you want more control then write your own policies. Start at Policies and permissions in IAM. You can also copy/paste the contents of a managed policy and then edit it down to just the permissions you want, and constrained to the resources that you want (e.g. to specific, named S3 buckets).
Is there an easy way to see what are the effective access permissions for a specific bucket? To be more specific about the environment, access to buckets is granted through identity policies, there are more than 170 IAM roles and users and 1000+ policies (not all of them are attached to IAM role or user). I need to see who has the s3:GetObject, s3:PutObject and s3:DeleteObject permission on a specific bucket. Is there some tool that can give me that kind of report? I can write a script that goes through all roles, policies attached to them, pulls out statements that contain specific bucket and then I can cross reference allows and denys, but I'm sure there is some smarter way of doing this.
I am not aware of any better way than you described. You can export your IAM settings (unless you already have them in CloudFormation or CDK scripts) as described at https://aws.amazon.com/blogs/security/a-simple-way-to-export-your-iam-settings/.
Then you can scan (manually or programatically) for policies of interest and to what users or roles are they attached.
From Using Access Analyzer for S3 - Amazon Simple Storage Service:
Access Analyzer for S3 alerts you to S3 buckets that are configured to allow access to anyone on the internet or other AWS accounts, including AWS accounts outside of your organization. For each public or shared bucket, you receive findings into the source and level of public or shared access. For example, Access Analyzer for S3 might show that a bucket has read or write access provided through a bucket access control list (ACL), a bucket policy, or an access point policy. Armed with this knowledge, you can take immediate and precise corrective action to restore your bucket access to what you intended.
As per AWS documentation here - You cannot switch roles when you sign in as the AWS account root user.
If we go by AWS best practices i.e. not to use root user to perform actions, this restriction makes sense & supports why AWS does not allow role switch as root user. However, when using a Bucket policy, a root user in one account can access a Bucket in another account & AWS does not seem restricting that unlike roles (Technically, both are cross account actions using resource policies).
Why does this 'root user restriction' apply only for roles and not buckets - Any security reasons?
Access to services is normally granted via IAM permissions on IAM Users, IAM Groups and IAM Roles.
Some AWS services also permit the creation of policies that can grant access to aspects of that specific service. Examples are:
Amazon S3 bucket policies
Amazon SQS queue access policies
Amazon SNS access policies
These policies can be used to grant cross-account access, and also unauthenticated access such as public access to objects in Amazon S3 buckets and the ability to send unauthenticated messages to an Amazon SQS queue.
These policies are used to grant additional access. They do not involve "assuming" any additional roles.
I think there is some misunderstanding on the use of roles and a bucket policy with external account's root as principle.
The roles are meant to be temporary assumed, for someone or something that normally does not have permissions for some action. This could be a user or service from same or different account.
However, when you use other account's root in a bucket policy principle, you are giving that account permanent (until manually revoked by you) trust to the bucket for all or some actions on it. You use root as the principle so that the owner of the other account can delegate access to its own users or roles. You fully trust the other account to manage the access to the bucket without your involvement.
Off course if you are not comfortable giving such trust to the other account, you can limit access to you bucket to a given IAM user or a role only. This will obviously limit the ability of the owner of the other account to delegate access to your bucket.
I am deploying a server program in an ec2 instance which needs to be able to create pre-signed urls for s3. So far I've had my AWS credentials in environment variables for testing, but I would like to switch to the IAM Role strategy now. However, I am unsure as to which policies the role should have access too. My initial guess is to have AmazonS3FullAccess, but the description says "Provides full access to all buckets via the AWS Management Console" but the ec2 instance will be using the c++ sdk, not the management console. Or is the policy not important, just that it has a policy so it gets credentials somehow?
You're confusing policies and roles.
a policy grants permissions to a user or to a role or to a group.
the difference between a user and a role is subtle, but basically a role is something that's assumed by other services in AWS, like an EC2 instance, while a user is generally just an identity you've created for use in AWS.
The policy description for full access may make mention to the management console, but it grants full access to all buckets whether through the console, the api or an sdk, they're all really the same thing under the hood.
You should not use the fullaccess policy. You could use it as a base to build your real policy, but IAM should always use the least privilege principal, where you only give the permissions that are absolutely required, in this case the role only needs read and possibly list permissions on the specific bucket in question if generating urls for reading, or put permissions if allowing uploads.