Stop 09 · Cloud SecurityTopics · 2/9

Cloud IAM Security

In short

In the cloud, identity is the real perimeter. IAM decides who can do what to every resource, and one over powerful key can hand an attacker the whole account.

Identity and Access Management in the cloud governs who can do what to every resource — overly permissive IAM policies are one of the most common real-world cloud security findings.

The blob at a hotel desk hands out a keycard that opens only one room.

Think of it like this

The hotel keycard system

A good hotel does not give every guest a master key. Your card opens only your room and the gym. Housekeeping gets a different card. Cloud IAM is that keycard system: each person and service gets exactly the access they need, no more.

Watch it happen

A request is checked against policy

User

IAM

Resource

read bucket reports

1/4A user or service asks to perform an action on a specific resource.

The big ideas

What you need to know

Least privilege

Grant the smallest permissions that let the job run. It limits the damage if a key is ever stolen.

Roles over users

Attach permissions to roles that services and people assume, instead of scattering long lived keys everywhere.

Short lived credentials

Temporary credentials that expire beat permanent access keys, which leak into code and logs and live forever.

Audit regularly

Permissions pile up over time. Review who can do what and strip the access nobody uses anymore.

See it in code

Walk through the code

json

1{2  "Version": "2012-10-17",3  "Statement": [{4    "Effect": "Allow",5    "Action": ["s3:GetObject"],6    "Resource": "arn:aws:s3:::reports-bucket/*"7  }]8}

1/2Effect Allow plus a single action: read objects. No write, no delete.

This policy allows read only access to one bucket and nothing else. Everything not listed is denied by default, which is exactly what you want.

Save yourself the pain

Common mistakes

Oops

Granting a wildcard policy that allows every action on everything.

Do this instead

List only the specific actions and resources the task needs. A broad key is a breach waiting to happen.

Oops

Using long lived access keys baked into code.

Do this instead

Prefer roles and short lived credentials. Hard coded keys leak into git and logs and never expire.

Your mission

Write a least privilege policy

~35 min

Quick check

What does the principle of least privilege mean for cloud IAM?

Go deeper

1Audit a sample IAM policy for overly broad permissions.
2Practice writing a least-privilege IAM policy scoped to a specific task.
3Learn why 'admin access for everyone' remains a common but serious cloud security anti-pattern.