Amazon Web Services

Cloud Providers

AWS Elastic Container Registry (ECR)

Cloud Services

AWS ECR Resource Policy: Block Outside Specific Public IP Range

AWS ECR: Permit Cross Account Image Upload

AWS ECR, Permit Cross Account Image Download

AWS Secrets Manager

AWS KMS

Principal Policy - Permit Access to Cross-Account Secret and KMS Key

AWS CloudFront

S3: Permit Only CloudFront Specific Distribution

Assume Role Trust Policy with Conditional to Limit to Specific Role

Amazon EC2

Assume Role Trust Policy from EC2 Instance

AWS Elastic Container Service (ECS)

Assume Role Policy to Permit ECS Task to Assume IAM Role

Allow Principals to Encrypt via KMS but Deny Decrypt via KMS

Amazon S3

(WARNING) Block All S3 Access Except Root

For our first member spotlight of 2022, we’re featuring a person whose numerous and ongoing contributions to the cloudsec community are only part of what make him so delightful. Plus, he’s a Parisian and a hobbyist photographer so double points.

You may know Victor Grenu aka zoph from his 

 service on Twitter or his AWS Security Digest (

!) which we both highly recommend to stay in the know.

In our Q&A with Victor, you’ll learn more about the inspiration behind MAMIP, other projects Victor has up his sleeve, and of course, his thoughts on IAM including what he’d change about default behavior. We also included a list of the resources Victor shares in his Q&A answers.

If you check out Victor’s social media and blog profiles, you’ll notice he has a couple golden mantras: 

Try to be a rainbow in someone else’s cloud

Making things boring with simple automation

. While we agree with the former (joy is one of our IAM Pulse Community principles!), we’d say for the latter that what Victor’s done with MAMIP in particular may be boring to some but we can all agree we wouldn’t want to be without it!

All the kudos to Victor for kicking off this year’s IAM in the Spotlight and sharing more of his background and IAM insights.


What's the technology you're most excited to learn and work with?

K8s. No – just kidding. Generally speaking, AWS security related technologies and I also love to find vulnerabilities on websites / apps I’m using personally. I found a few last year that led to generating a few bug-bounty rewards.

What project are you working on now that most excites you?

I’m working in my free time (so not so much), on a micro-SaaS product around AWS FinOps and waste detection. I hope to open beta test in 2022 and see what is happening next. Small bet.

 who used to run CLI commands on his laptop periodically. I wanted to apply some automation and visibility where cloudsec folks are – on Twitter.

With this new regularity we could spoil services / feature releases from AWS as announcements / blog posts (almost) synchronized to the release / update of corresponding IAM Managed Policies. It also provides us the capability to keep history and see what is happening: release / error / rollback of IAM Managed Policies as everything is on git.

What’s the most surprising notification you received from your MAMIP service?

I think the most surprising notification was SupportServiceRolePolicy and internal AWS policies that have been pushed to public by error. I maintain a 

, to keep track of AWS failures on AWS Managed Policies.

) that provides potential threats over IAM Managed Policies (resource exposure, privilege escalation, etc...).

Describe the strangest AWS environment you’ve walked into on a client job.

A small startup where all resources were on public subnets, “isolated” from each other with subnetting, IAM roles with trust-policies on AWS: “*” and full of AccessKeys/SecretKeys without any rotation. 


We started again from scratch with new accounts setup and deleted this legacy one. Really big time here :)

What motivates you to share your work and expertise with the larger community?

I really like the usage of social media in my daily work, I love to be able to talk directly with the senior leadership team of AWS Security and developers on Twitter.
Asking questions, sharing thoughts with other customers, helping each other is our only option, right?

Where do you think IAM is going to go next?

I think they [cloud providers] will work on simplicity, a more comprehensive language, especially for new comers. They will integrate helpers and tooling that comes from OSS from the community. Policy validation, simulation, better error messages, etc...

I am already talking to AWS IAM teams using Twitter or CloudSecurity Forum (Slack). I am also (for the second year) part of the AWS Community Builders program that allows me to have a privileged communication channel to AWS Teams.

If you could change one thing about how IAM works, what would it be?

I will change default behavior for many things like: 

- Required MFA on root account
- Disable the ability of the root user to create AccessKey/SecretKey
- Better Default password policy
- Encryption by default on many services: SQS, S3, EBS Volumes etc..
- Default to IMDSv2 for EC2 Instances- etc..

What's the one thing companies should be doing that they're not?

Take IAM seriously, and ask help from external consulting firms to outsider feedback on their AWS security posture.

What's the most fun project you've ever worked on?

In my free time I like to participate in CTF especially on hacking conferences. I loved to participate with friends at “TheHack” a French hacking conf. I hope to participate in larger conferences after the pandemic. (CCC, Blackhat, DEFCON).

If computers magically no longer existed, what would you do for a career?

Renovate and open a guest room in one of beautiful regions of France.

, DIY, renovation of an old house (1958), and some woodworking.


MAMIP - Monitor AWS Managed IAM Policies Changes


Adopt a slow-tech approach by reading only essential, digest summary of what is going on in the AWS Security landscape.

What you will find:
- Highlight of the week
- Change since last week on AWS Managed IAM Policies
- Curated Cloud Security Newsletters
- AWS API changes
- IAM Permissions changes
- Most upvoted posts on r/AWS
- Top shared links on Twitter (by cloudsec folks)
- Most engaged Tweets from the community

https://github.com/z0ph/MAMIP/blob/dev/HALL_OF_FAILS.md


Cloud Security Forum on Slack (send a DM to 

IAM in the Spotlight - Victor Grenu

Since we first launched the IAM Pulse community a few months ago, our members have contributed a wealth of knowledge in article form – topics ranging from 

designing least privilege access controls

. We aim to give cloud professionals a platform to share their expertise and build their personal brand in a low effort, high impact way. I’m excited to introduce a new type of technical content that our members can publish, and the community as a whole can engage with – IAM Policy documents.

Policies are the backbone of each cloud provider’s IAM services. They specify 

. Every cloud provider has a unique (and complex) specification for IAM policies, however each can be represented as JSON documents. When designing for least privilege access, it’s best to avoid the defaults, and customize policies to the nature of your workloads and your teams. But have you ever opened up your code editor and stared blankly at where to start? Our IAM Policy Catalog is a place to browse usable and customizable examples to get you on your way.

 is a browsable and searchable index of member contributed IAM Policy documents, filterable by provider and service. Want to keep your team’s permissions fine-grained by tag? Spinning up a Lambda function and want to write a policy for the attached role? Find an example from the community here. Once you find a policy that matches your needs, you can tailor to your environment by substituting the inline variables to your values.

Community members can contribute their own examples to the Catalog through a simple form wizard. Policies are specified for a specific cloud provider, and optionally tagged for services impacted such as Amazon EC2 and S3. Paste your JSON code in the editor and add any documentation as markdown. To help the reader customize, follow the instructions to carve out variables individually. When you’re ready, publish your Policy to get added to the Catalog.

 today. To publish a Policy to the Catalog, membership to the IAM Pulse community is free – 

 to personalize your profile and start contributing your knowledge. Shared learning drives collective intelligence!

A community-led catalog of customizable IAM Policy document examples across AWS, GCP, and Azure.

Introducing the IAM Policy Catalog

Earlier today, Olympia (our Head of Community) and I were guests on 

 Twitter space, where we talked about our take on DevRel, how we're building a community, and what our goals are. Given the broad range of topics, and speaking about our goals, we decided to expand a bit and share a written version here. 

When IAM Pulse approached me to join the Community team, and I imagined myself helping the whole world learn cloud security, I immediately said yes. And then I thought about it, and asked them what that means. DevRel, a function that used to be found only at large companies, has taken off and is growing in popularity. However, if you ask each DevRel practitioner what their job is, you’re going to get a lot of different answers - similar to asking someone who practices DevOps exactly what their job is.

Developer relations and developer advocates come in all shapes and sizes, and focus on different things. As far as I can tell, the role describes:

 - Raise public awareness of a brand and build a network

 - Build things using the company’s tools or platform themselves. They find rough edges public developers would find and use their internal connections to get things fixed up

 - Work to bring users onto a platform in a concrete “users” and “dollars” sense

 - At the forefront of technology, they identify the boundaries of what products can do, and push those boundaries. They advise the product team to integrate any ideas they have

 - Write trainings and build up help docs. Documentation touches a lot of these areas!

 - Answer questions in online forums or respond to customer requests in a customer service-like role

And as with most long-winded explanations, the real answer is closer to “all of the above” (especially at smaller companies!). DevRel means connecting with users of a platform or product, often using social media. Then learning their trials and tribulations with using your platform or tooling, often by testing it out yourself, which can help you become an expert at it. And then potentially helping your dev teams focus on the competitive advantages you see your product having in the market, and telling folks about it. It’s a lifecycle of customer feedback to improve the product and developer experience.

In the same way that DevOps attracts engineers with multiple specialties, DevRel does too. DevOps is being a developer and also knowing how to run services, what we call “Operations.” And DevRel is being a developer and also fostering a relationship with the community at large. 

DevRel is interesting in this very technical field due to it attracting “authentic” people - those that can connect with others and build strong relationships. Often DevOps, or internal development attracts very technical, serious people. They’re folks you can rely on, and who will answer the phone on Saturday night when you very much need them to repair your services. With DevRel, you want engaging, empathetic teachers, folks who have the social skills and patience to take your questions and help you do an even better job in your own career. These folks have outsized personalities, and are often popular on blogging, social media, and speaking circuits, and are often at the top of their fields (or at least their social profile makes it seem that way). 

DevRel, just like DevOps, is rapidly evolving, and it’s fascinating to be a part of it. I hope I am of service to all of you in all the ways I said above, and if you have suggestions, corrections, or want to help push this industry forward, let me know. 

DevRel Without a Platform

What is a Cloud IAM Advocate?

AWS CloudFormation

Code Frameworks

Terraform

AWS IAM actions autocomplete, documentation and wildcard resolution for Visual Studio Code.  Supports Serverless Framework, AWS SAM, CloudFormation and Terraform.

IAM Legend

A handy and info-filled cheat sheet for AWS IAM created by IAM Pulse member Tobias Schmidt

AWS IAM Cheat Sheet

Identity and Access Management on AWS is an integral part of ensuring the correct people have access to the appropriate services, applications, and organizations. Learn IAM from Brian Eiler

PluralSight IAM Skills Path

Microsoft Azure

Google Cloud Platform

From IAM mastermind Ian Mckay, this website is a comprehensive dataset, gathered within IAM Dataset, of all IAM permissions across AWS, GCP, and Azure.

permissions.cloud

Matt Fuller (Stripe) compiled an incredibly comprehensive list of all the methods to use AWS accounts as security boundaries, and more importantly, how to get around them

AWS Accounts as Security Boundaries 

From Hacking in the Cloud, check out these common techniques that can be leveraged to escalate privileges in an AWS account. We recommend pairing with IAM Vulnerable (Open Source Tool) for a good time.  

AWS IAM Privilege Escalation Techniques

A comprehensive guide from Marco Lancini (CloudSecList) to help Security teams maintain visibility across multi-account AWS environments via logging, monitoring, and alerting.

Security Logging in Cloud Environments - AWS

Principal Mapper (PMapper) is a script and library for identifying risks in the configuration of AWS Identity and Access Management (IAM) for an AWS account or an AWS organization

Principal Mapper

A comprehensive reference guide to AWS Access Keys including what they are, how to identify different types, and where you're likely to find them.

AWS Access Keys - A Reference 

A selection of example Amazon DynamoDB and DAX IAM policies with more restrictive security that you should be using instead of the official AWS Managed policies for DynamoDB.

Amazon DynamoDB IAM Policies

Cheat Sheet: AWS Elastic Container Registry (ECR)

Cheat Sheet: AWS Secrets Manager

AWS IAM Deep Dive. Chapter 3: Credential evaluation, Principals, Conditions, Policy variables

Cheat Sheet: AWS KMS

Cheat Sheet: AWS S3

AWS IAM: Best practices [Part 1]

As a software developer, you're constantly in demand... and being demanded to learn new things constantly. AWS IAM is a topic that keeps coming up – but how much should you really learn about it?

IAM a Developer - What Do I Really Need to Know About AWS IAM?

Least Privilege, IAM Groups, and IAM Strategy

Takeaways from AWS IAM

AWS IAM: The challenge

Controlling AWS EKS Access Using AWS IAM And Kubernetes RBAC

AWS Cloud Delivery Kit. Define cloud infrastructure using familiar programming languages.

AWS CDK

AWS CloudFormation gives you an easy way to model a collection of related AWS and third-party resources, provision them quickly and consistently, and manage them throughout their lifecycles, by treating infrastructure as code. A CloudFormation template describes your desired resources and their dependencies so you can launch and configure them together as a stack.

AWS Key Management Service (AWS KMS) is a managed service that makes it easy for you to create and control the cryptographic keys that are used to protect your data. 

AWS Lambda is a serverless, event-driven compute service that lets you run code for virtually any type of application or backend service without provisioning or managing servers. You can trigger Lambda from over 200 AWS services and software as a service (SaaS) applications, and only pay for what you use.

AWS Lambda

AWS Secrets Manager helps you protect secrets needed to access your applications, services, and IT resources. The service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle.

AWS Security Token Service (STS)

Amazon API Gateway is a fully managed service that makes it easy for developers to create, publish, maintain, monitor, and secure APIs at any scale.

Amazon API Gateway

Amazon DynamoDB is a fully managed NoSQL database service that provides fast and predictable performance with seamless scalability.

Amazon DynamoDB

Amazon Elastic Compute Cloud (Amazon EC2) is a web service that provides secure, resizable compute capacity in the cloud. It is designed to make web-scale cloud computing easier for developers. Amazon EC2’s simple web service interface allows you to obtain and configure capacity with minimal friction. It provides you with complete control of your computing resources and lets you run on Amazon’s proven computing environment.

Amazon Relational Database Service (Amazon RDS) makes it easy to set up, operate, and scale a relational database in the cloud.

Amazon RDS

Amazon Simple Storage Service (Amazon S3) is an object storage service offering industry-leading scalability, data availability, security, and performance.

Amazon Simple Queue Service (SQS) is a fully managed message queuing service that enables you to decouple and scale microservices, distributed systems, and serverless applications.

Amazon SQS

Amazon Web Services (AWS) is the world’s most comprehensive and broadly adopted cloud platform, offering over 200 fully featured services from data centers globally. Millions of customers—including the fastest-growing startups, largest enterprises, and leading government agencies—are using AWS to lower costs, become more agile, and innovate faster.

Ansible is an open-source software provisioning, configuration management, and application-deployment tool enabling infrastructure as code. It runs on many Unix-like systems, and can configure both Unix-like systems as well as Microsoft Windows.

Ansible

Chef is a company and the name of a configuration management tool written in Ruby and Erlang. It uses a pure-Ruby, domain-specific language for writing system configuration recipes.

Chef

Google Cloud Platform, offered by Google, is a suite of cloud computing services that runs on the same infrastructure that Google uses internally for its end-user products, such as Google Search, Gmail, file storage, and YouTube.

Kubernetes is an open-source container-orchestration system for automating computer application deployment, scaling, and management. It was originally designed by Google and is now maintained by the Cloud Native Computing Foundation.

Kubernetes

Technical Themes

Microsoft Azure, commonly referred to as Azure, is a cloud computing service created by Microsoft for building, testing, deploying, and managing applications and services through Microsoft-managed data centers.

Open-source software is computer software that is released under a license in which the copyright holder grants users the rights to use, study, change, and distribute the software and its source code to anyone and for any purpose. Open-source software may be developed in a collaborative public manner. 

Open Source

Pulumi's open source infrastructure as code SDK enables you to create, deploy, and manage infrastructure on any cloud, using your favorite languages.

Pulumi

Puppet is a software configuration management tool which includes its own declarative language to describe system configuration. It is a model-driven solution that requires limited programming knowledge to use. Related: See Chef, SaltStack, Ansible.

Puppet

Serverless computing is a cloud computing execution model in which the cloud provider allocates machine resources on demand, taking care of the servers on behalf of their customers.

Serverless

Terraform is an open-source infrastructure as code software tool created by HashiCorp. Users define and provide data center infrastructure using a declarative configuration language known as HashiCorp Configuration Language (HCL), or optionally JSON.

The zero trust security model, sometimes known as perimeterless security, describes an approach to the design and implementation of IT systems.

IAM THEREFORE I THINK?

We're a community of cloud practitioners helping each other reason with the complexities of IAM policies and configurations

New content from our members

Cheat Sheet: AWS Elastic Container Registry (ECR)

Cheat Sheet: AWS Secrets Manager

AWS IAM Deep Dive. Chapter 3: Credential evaluation, Principals, Conditions, Policy variables

Cheat Sheet: AWS KMS

Cheat Sheet: AWS S3

AWS IAM: Best practices [Part 1]

IAM a Developer - What Do I Really Need to Know About AWS IAM?

Takeaways from AWS IAM

AWS IAM: The challenge

Controlling AWS EKS Access Using AWS IAM And Kubernetes RBAC

Subscribe to our Newsletter

Cheat Sheet: AWS Secrets Manager

Clean Up the AWS Kitchen Sink

IAM THEREFORE I THINK?

We're a community of cloud practitioners helping each other reason with the complexities of IAM policies and configurations

New content from our members

Cheat Sheet: AWS Elastic Container Registry (ECR)

Cheat Sheet: AWS Secrets Manager

AWS IAM Deep Dive. Chapter 3: Credential evaluation, Principals, Conditions, Policy variables

Cheat Sheet: AWS KMS

Cheat Sheet: AWS S3

AWS IAM: Best practices [Part 1]

IAM a Developer - What Do I Really Need to Know About AWS IAM?

Takeaways from AWS IAM

AWS IAM: The challenge

Controlling AWS EKS Access Using AWS IAM And Kubernetes RBAC

Subscribe to our Newsletter

Cheat Sheet: AWS Secrets Manager

Clean Up the AWS Kitchen Sink

Get the IAM Pulse Check Newsletter