IAM policy power hour
summary
Five live demos show concrete controls and results: an org-level SCP that denies S3 copy outside the org blocks a developer from copying into a Pickles bucket; org-level Access Analyzer (external + unused findings) surfaces cross-account DynamoDB and many unused roles and access keys; three new automated-reasoning APIs (check-no-new-access, access-not-granted, check-no-public-access) evaluate policies; console/API policy recommendations remove unused actions and resolve findings after policy replacement. RAM and permission boundaries are used for safe sharing.
AI-written summary · about
chapters (17)
- 0:00Introduction to IAM
- 1:12Understanding IAM Policies
- 6:03Types of IAM Policies
- 6:53Policy Evaluation Logic
- 9:13Cross-Account Access
- 12:18Security and Builder Teams
- 14:42Establishing Data Perimeters
- 16:59Restricting Access
- 20:14Resource Policies and RAM
- 23:20Policy Generation and Validation
- 26:24Automated Policy Reasoning
- 28:58Live Validation Demo
- 32:10Preventing Public Access
- 36:44Access Analyzer Findings
- 38:59Remediating Unused Access
- 42:00Policy Recommendations Demo
- 47:32Key Takeaways and Resources
related talks
19mMove toward least privilege with IAM Access Analyzer
19mFoundations of data security
37mLocking Down the Security of IAM
19mManaging access to your Amazon S3 buckets and objects
58mCreate enterprise-wide preventive guardrails
51mPermissions: Centralized or Decentralized? Both!
19mS3 Block Public Access overview and demo
29mAiIAM: Transforming the Democratized AWS IAM...