# IAM

## Users

* Each account has it's own root user. This user can do anything in that account and cannot be disabled.
* SCP can be used to deny every call for the root account. While it doesn't disable it and people can still log in, it can't do anything.
* Management account = a root user too
* Best to limit the amount of IAM users because they are usually over permissioned.
* **Federated user/SSO**: Can be federated with Okta or Entra ID.

**CLI/Cloudshell:**

```
aws iam list-users
```

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2F5ESaxBgkbv6PbPvBZLPE%2Fimage.png?alt=media&#x26;token=29b06f2e-b0e1-4213-bfdd-31f30736878c" alt=""><figcaption></figcaption></figure>

### **IAM User Properties:**

{% embed url="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-user.html" %}

*   `Groups`

    A list of group names to which you want to add the user.
*   `LoginProfile`

    Creates a password for the specified IAM user. A password allows an IAM user to access AWS services through the AWS Management Console.
*   `ManagedPolicyArns`

    A list of Amazon Resource Names (ARNs) of the IAM managed policies that you want to attach to the user.
*   `Path`

    The path for the user name. For more information about paths, see [IAM identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) in the _IAM User Guide_.
*   `PermissionsBoundary`

    The ARN of the managed policy that is used to set the permissions boundary for the user.

    A permissions boundary policy defines the maximum permissions that identity-based policies can grant to an entity, but does not grant permissions.
*   `Policies`

    Adds or updates an inline policy document that is embedded in the specified IAM user. To view AWS::IAM::User snippets, see [Declaring an IAM User Resource](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/quickref-iam.html#scenario-iam-user).
*   `Tags`

    A list of tags that you want to attach to the new user. Each tag consists of a key name and an associated value. For more information about tagging, see [Tagging IAM resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html) in the _IAM User Guide_.
*   `UserName`

    The name of the user to create. Do not include the path in this value.

    \


## IAM User Groups

* Users can be listed together in IAM User Groups and permissions can be assigned to the group.

**CLI/Cloudshell:**

```
aws iam list-groups
```

{% embed url="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-group.html" %}

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FuZhOqY40qZFxO1ociAkN%2Fimage.png?alt=media&#x26;token=6603743e-1ddb-4e10-b544-62ebbc097d9a" alt=""><figcaption></figcaption></figure>

## Roles

* A role has two major components
  * What the role is allowed to do → (IAM permissions policy)
  * Who is allowed to take on the role → (trust policy)
* Taking a role in AWS is called an **AssumeRole** action this allows us to temporarily take on a role without needing an IAM user and credentials in the target account
* The service that makes this possible in AWS is Security Token Service (STS).
  * STS gives temporary credentials for a role.
* **Cross tenant access**
  * Roles can be assumed from a different AWS tenant (attacker > victim).
    * IAM role trust policy allows external user to **AssumeRole**.
  * Won't detect this in IAM users or IAM policies, because it is defined in the **IAM roles**.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FKiaX6yvixssD2HxCfkF3%2Fimage.png?alt=media&#x26;token=b2df70af-7ca5-4789-9219-39a1ff6eb524" alt=""><figcaption></figcaption></figure>

### AssumeRole:

* Provides temporary access key for user to use.

**CLI/Cloudshell:**

```
aws sts assume-role --role-arn EXAMPLE --role-session-name EXAMPLE
```

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2Fd828sFWT916DFELZH0q7%2Fimage.png?alt=media&#x26;token=18a12210-9656-4b1c-ad51-5dee679f6e80" alt=""><figcaption></figcaption></figure>

* Provide credentials to .env variables in AWS CLI to assume role automatically.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FVj7YqYlhRFyMWOqgUdu0%2Fimage.png?alt=media&#x26;token=d9646324-5a2b-4baf-bea1-32db4a59df87" alt=""><figcaption></figcaption></figure>

### Role Chaining

* Roles can also assume other roles which is called role chaining which makes it even more complex to investigate who was ultimately responsible.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FfRffBX5GGIYfssofCWGE%2Fimage.png?alt=media&#x26;token=a0e8c2ed-bae4-48f3-b184-e2dbd3149d50" alt=""><figcaption></figcaption></figure>

### Security Token Service (STS)

* Expiration time on tokens is definable.
  * Because sessions for access keys expire; if the TA has extended access, there will be multiple access keys for us to investigate.
* Minimum access key lifetime: 15 mins

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FTIbB6aNq4RkWm5rumWvc%2Fimage.png?alt=media&#x26;token=beef33e3-a600-4aa6-9052-a18125b55df3" alt=""><figcaption></figcaption></figure>

### Access Analyzer

* Paid service that helps find 'dangerous' roles as well as finding over permissioned roles and potentially roles you don’t need any more.
* **External access findings (FREE)**
  * Review any IAM roles/policies for Public Access
  * Review any IAM roles/policies for Cross-Account Access
* Unused access findings (PAID)
  * Finds unused roles, access keys, IAM user that are obsolete.
* Takes hour or hours to run.

## Policies

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FmHDeFeSsq3gCTsraVYfW%2Fimage.png?alt=media&#x26;token=7b231602-7dc8-44b7-9be2-0bd1a1c49652" alt=""><figcaption></figcaption></figure>

* **Big 3 policies** (seen most often):
  * **Identity based**
    * Assigned to identities (IAM users, IAM groups)
  * **Resource based**
    * Assigned to resources (S3s, EC2s, etc).&#x20;
    * Example: Allow a specific IP to talk to an S3 bucket only.
  * **Service Control Policy (SCP)**
    * Assigned to organization OUs. Used to set guardrails in AWS.&#x20;

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FtaXIYsETsu6EEiy6mWQU%2Fimage.png?alt=media&#x26;token=48a7a8c0-9194-4b27-a894-f7fafeade6a5" alt=""><figcaption></figcaption></figure>

### External Access Policies:

[https://yehudacohen.substack.com/p/a-quick-overview-of-aws-principals](https://yehudacohen.substack.com/p/a-quick-overview-of-aws-principals)

* Identity-based policies cannot expose your resources in your AWS account to principals that exist outside of your AWS account.
* If you want to grant a principal outside of your AWS account access to your AWS account, you must use a resource-based policy.

### Policy Examples:

### Identity Based

* **Effect:**
  * Allow or deny (default is deny).
* **Action**:
  * The specific API calls (Get, Put, Post, etc)
* **Resource:**
  * Object the policy is applied to.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FZxSfvHThCiPqjFwd3gPT%2Fimage.png?alt=media&#x26;token=6235ca7a-1a1c-4de5-9f6b-a9b1591ef552" alt=""><figcaption></figcaption></figure>

### Resource Based:

* **Effect:**
  * Allow or deny (default is deny).
* **Action**:
  * The specific API calls (Get, Put, wildcard \*)
* **Principal**:
  * Allows external accounts to access resource.
* **Resource:**
  * Resource the policy is applied to.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2F7nHjUEo47vUYg1XhIzju%2Fimage.png?alt=media&#x26;token=e2b326f2-dcf8-47ce-9615-223d71f3a4d7" alt=""><figcaption></figcaption></figure>

### Service Control Policy:

* **Effect:**
  * Allow or deny (default is deny).
* **Action**:
  * The specific API calls (Get, Put, wildcard \*)
* **Resource:**
  * OU the policy is applied to.
  * Applied to all AWS accounts under OU.
* **Condition**:
  * Boolean conditions that policy abides by.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FmDNbsZzXPMgC9UPULo5q%2Fimage.png?alt=media&#x26;token=ef4a648a-b165-4b38-b87e-4f9c21a1bbc6" alt=""><figcaption></figcaption></figure>

### IR Policies:

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FSw9kHCCniS4cK0RKgIoR%2Fimage.png?alt=media&#x26;token=96e2f4df-9106-4808-a691-d7dc09c03383" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FIlHW0PuOR6eYdWjX6mTf%2Fimage.png?alt=media&#x26;token=325cc2f3-a1d0-4dc0-af40-bb185526272e" alt=""><figcaption></figcaption></figure>

### Policy Evaluation:

* By default everything is denied, unless there is an allow somewhere along the evaluation.
  * If there is an explicit deny somewhere along the hierarchy, it will be denied.
  * If there is an allow in the hierarchy, it will be allowed. **UNLESS** there is an explicit deny lower in the chain.
* Organization SCP:
  * If there is a deny at this stage, the evaluation will stop before looking at the lower level policies.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FMD9etCB7ADV8eTBgxLl1%2Fimage.png?alt=media&#x26;token=16d8651b-36e4-411f-bcea-36c321762434" alt=""><figcaption></figcaption></figure>

{% embed url="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html" %}
