HackBlue

Labs / Identity and access

AWS IAM policy evaluator

Walk one request through an SCP, a permissions boundary, an identity policy, and an explicit deny, and see exactly which layer decides the outcome.

  • Interactive lab
  • Advanced
  • 5 steps
  • 0 of 5 solved

Goal

Every request from arn:aws:iam::111122223333:role/ci-deploy passes through three policies: the organization's service control policy, the role's permissions boundary, and the identity policy attached to the role.

Pick a request, change the region or MFA state, and follow the evaluation. An explicit deny anywhere ends it. Otherwise every layer must contain a matching allow.

Preset requests

Context

Requesteu-west-1
Principal
arn:aws:iam::111122223333:role/ci-deploy
Action
s3:GetObject
Resource
arn:aws:s3:::build-artifacts/app-1.4.2.zip
  1. allow
    Service control policy (organization)Matched statement AllowAll
  2. allow
    Permissions boundary on the roleMatched statement BoundaryCeiling
  3. allow
    Identity policy attached to the roleMatched statement ReadAnyBucket

Allow. Every layer allows the request and nothing denies it.

Service control policy (organization)
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAll",
      "Effect": "Allow",
      "Action": "*",
      "Resource": "*"
    },
    {
      "Sid": "DenyOutsideEU",
      "Effect": "Deny",
      "NotAction": [
        "iam:*",
        "sts:*",
        "organizations:*"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": [
            "eu-west-1",
            "eu-central-1"
          ]
        }
      }
    }
  ]
}
Permissions boundary on the role
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BoundaryCeiling",
      "Effect": "Allow",
      "Action": [
        "s3:*",
        "logs:*",
        "ec2:Describe*"
      ],
      "Resource": "*"
    }
  ]
}
Identity policy attached to the role
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadAnyBucket",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": "*"
    },
    {
      "Sid": "WriteArtifacts",
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::build-artifacts/*"
    },
    {
      "Sid": "DeleteWithMFA",
      "Effect": "Allow",
      "Action": "s3:DeleteObject",
      "Resource": "arn:aws:s3:::build-artifacts/*",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        }
      }
    },
    {
      "Sid": "ManageInstances",
      "Effect": "Allow",
      "Action": "ec2:*",
      "Resource": "*"
    },
    {
      "Sid": "NeverBackups",
      "Effect": "Deny",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::prod-backups",
        "arn:aws:s3:::prod-backups/*"
      ]
    }
  ]
}

Steps

  1. 01The identity policy allows ec2:*. Which layer stops ec2:RunInstances?

  2. 02Reading the same artifact from us-east-1 is denied. Which layer decides?

  3. 03ReadAnyBucket allows s3:GetObject on every resource. What happens to the production backup read?

  4. 04The delete request is implicitly denied. Which condition key must be true for it to succeed?

  5. 05With MFA off, how many of the five preset requests are allowed?