Introduction

Introduce

After understanding how IAM User, Group, Policy, and Role work in the previous 2 labs, in this lab, we will continue to learn about IAM Permission Boundary.

What is IAM Permission Boundary?

• IAM Permission Boundary is an advanced feature that allows us to limit the maximum permissions of a User or Group. Assuming we apply a Permission Boundary that only allows the EC2admin user to administer the EC2 service, then that user will not be able to have permissions on any other service, even if assigned a higher permission Policy.

• Therefore, the effective permissions of user EC2admin will include those allowed by both the Permission Boundary and user EC2admin’s permissions policy (Identity-based policy).

Why use IAM Permission Boundary?

• Usually, when you grant permissions to IAM users, you might think that by building the permission policy for the user carefully, you can skip using the Permission Boundary.

• However, as the number of users increases and continuous changes in user work roles require you to create more new permission policies, the management of permissions becomes complicated, thereby creating vulnerabilities for privilege escalation in users.

• To simplify permission management, instead of having to edit permission policies individually, you can apply Permission Boundary quickly and in bulk to help you close privilege escalation vulnerabilities.