Cloud Security & IaC Engineering: Secure AWS IAM Architecture & Permission Boundaries

Identity and Access Management (IAM) is the primary security perimeter in AWS. Overly permissive policies ("Action": "*", "Resource": "*") are the root cause of the vast majority of cloud data breaches.

In this first part of our Practical Cloud Security & IaC Defense playlist, we design secure AWS IAM permission boundary architectures, implement Attribute-Based Access Control (ABAC), and integrate static IaC analysis into Terraform pipelines using Checkov and tfsec.

---

1. AWS IAM Evaluation Logic & Permission Boundaries

When AWS evaluates an API request, it evaluates explicitly denied permissions first. An implicit deny applies unless an explicit allow statement exists.

       ┌────────────────────────┐
       │   AWS API Request      │
       └───────────┬────────────┘
                   │
                   ▼
       ┌────────────────────────┐         YES
       │  Explicit Deny Found?  │ ─────────────────> 🚫 ACCESS DENIED
       └───────────┬────────────┘
                   │ NO
                   ▼
       ┌────────────────────────┐         NO
       │ Service Control Policy │ ─────────────────> 🚫 ACCESS DENIED
       │      (SCP) Allow?      │
       └───────────┬────────────┘
                   │ YES
                   ▼
       ┌────────────────────────┐         NO
       │  Permission Boundary   │ ─────────────────> 🚫 ACCESS DENIED
       │         Allow?         │
       └───────────┬────────────┘
                   │ YES
                   ▼
       ┌────────────────────────┐         YES
       │  Identity Policy Allow │ ─────────────────> ✅ ACCESS GRANTED
       └────────────────────────┘

---

2. Implementing IAM Permission Boundaries in Terraform

Permission boundaries restrict the maximum permissions an IAM role can delegate, preventing developers from escalating their privileges even if they possess iam:CreatePolicy permissions.

# Permission Boundary Policy: Prevents deleting audit logs or creating admin roles
resource "aws_iam_policy" "developer_boundary" {
  name        = "DeveloperPermissionBoundary"
  description = "Maximum permissions allowed for developer roles"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid      = "AllowServices"
        Effect   = "Allow"
        Action   = [
          "s3:*",
          "ec2:*",
          "lambda:*",
          "dynamodb:*"
        ]
        Resource = "*"
      },
      {
        Sid      = "DenyCloudTrailTampering"
        Effect   = "Deny"
        Action   = [
          "cloudtrail:StopLogging",
          "cloudtrail:DeleteTrail"
        ]
        Resource = "*"
      }
    ]
  })
}

# Attach Boundary to IAM Role
resource "aws_iam_role" "developer_role" {
  name                 = "AppDeveloperRole"
  permissions_boundary = aws_iam_policy.developer_boundary.arn
  assume_role_policy   = data.aws_iam_policy_document.ec2_assume.json
}

---

3. Automated IaC Static Security Scanning with Checkov

Prevent misconfigurations before terraform apply by embedding Checkov into your git workflow:

# Scan Terraform directory for security violations
checkov -d ./infra/terraform --framework terraform --output cli

Example Checkov Pre-commit Hook

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/bridgecrewio/checkov
    rev: '3.2.0'
    hooks:
      - id: checkov
        args: ['-d', '.', '--framework', 'terraform']

In Part 2 of this playlist, we explore Terraform Remote State Hardening & S3 Bucket Policy Defense.