amazon-web-services - 适用于 cloudformation 的最小权限 AWS IAM 策略

Question

对于小型 CloudFormation 和 CodePipeline 模板，我们可以“尝试 - 测试”以获得所需角色的最低权限 IAM 策略。

这通常涉及:

• 从最低限度的政策开始
• 创建堆栈
• 失败并显示 - 堆栈没有对 someService:someAction 的权限
• 将服务操作添加到政策
• 更新堆栈并重试

对于较大的 CloudFormation 模板，此方法太耗时。
您如何制定最低权限 IAM 策略？

想法:

• 允许“*”，然后抓取 cloudtrail 中的事件，并为列出的事件构建映射到其等效角色 - 然后将角色减少到仅在 cloudtrail 日志中列出的角色。

  • 如果您可以将操作隔离到用户名，这会有所帮助

  • https://github.com/byu-oit-appdev/aws-cloudwatch-parse

• 访问顾问

Answer 1

Grant least privilege是有据可查的 IAM Best Practice 。该文档建议使用 Access Advisor 逐步添加特定权限。选项卡来确定应用程序实际使用哪些服务(可能在测试阶段使用更广泛的权限集):

It's more secure to start with a minimum set of permissions and grant additional permissions as necessary, rather than starting with permissions that are too lenient and then trying to tighten them later.

Defining the right set of permissions requires some research to determine what is required for the specific task, what actions a particular service supports, and what permissions are required in order to perform those actions.

One feature that can help with this is the Access Advisor tab, which is available on the IAM console Summary page whenever you inspect a user, group, role, or policy. This tab includes information about which services are actually used by a user, group, role, or by anyone using a policy. You can use this information to identify unnecessary permissions so that you can refine your IAM policies to better adhere to the principle of least privilege. For more information, see Service Last Accessed Data.

此方法类似于抓取 CloudTrail 以获取特定 IAM 角色/应用程序生成的 API 事件，尽管后者可能更难以过滤整个事件流以查找相关事件，而访问顾问列表是已经为您过滤了。