The Power of AWS Tags
summary
Shows a concrete AWS pattern called Control Tags that enforces ABAC integrity by prefixing tags (ctl:) and combining an organization-wide SCP with tag-based deny rules. Implementation uses SCPs, tag inspection, CloudTrail auditing, a Lambda cleanup job and a simple key/value tag payload called a 2PA ticket to require a second human before destructive actions (demo: a tagged approval lets a user delete a bucket). Claims it blocks privilege escalation, runs in production since 2019, and is now open source.
AI-written summary · about
chapters (8)
- 0:00Introduction and problem
- 6:50Modern authorization and ABAC
- 13:21Control tags framework
- 15:30Demo of two-person approval
- 18:01Anti-impersonation and anti-che
- 20:52Two-person approval seals
- 21:58Extending approvals to Kubernetes
- 23:02Summary and open source
related talks
26mThe Power of AWS Tags (Advanced IAM Session)
31mScale Permissions Management With Attribute-based Access Control
27mIntroduction to AWS Security
58mCreate enterprise-wide preventive guardrails
44mGuardrails in the Cloud
27mIntroduction to AWS Security
30mBest Practices for Terraform AWS Tags
59mProvably secure authorization