Validate your IAM policies with AWS CloudFormation hooks
summary
CloudFormation hooks run at provisioning time and invoke a Lambda that calls the IAM Access Analyzer ValidatePolicy API to check IAM identity and resource policies (over 130 checks) and return error, security warning, warning, or suggestion findings; the hook can be configured with FailureMode: Warn/Fail and an IgnoreFindingsWith exceptions list, and will block a CreateStack/stack set deployment (rollback) when configured severities are flagged; works with AWS CDK and can deploy across an organization.
AI-written summary · about
chapters (6)
- 0:00Understanding cloud hooks
- 2:21IAM policy validation
- 4:18Building a validation hook
- 6:47Implementation steps
- 7:53Demo and configuration
- 14:15Extending hook capabilities
related talks
41mRefine unused access confidently with IAM Access Analyzer
37mLocking Down the Security of IAM
32mWhizBangLambdaFix: where AWS Misconfigurations...
42mBlowing Up Serverless Security with IAM (And How to Avoid It)
23mGetting started with identity on AWS
29mAiIAM: Transforming the Democratized AWS IAM...
12mArmor cloud security: Security & compliance in the public cloud
28mYour journey to temporary credentials in the cloud