Identity and Access Management (IAM)

Who can do what

Every API call in the cloud is checked: who is calling (an identity), what they want to do (an action), on which resource, and whether a policy allows it.

Principles

• No long-lived keys for people: sign in through SSO with MFA and get temporary credentials.
• Workloads use roles, not access keys: an EC2 instance profile, an IAM role for a Kubernetes service account, a Lambda execution role; on Azure a managed identity; on Google Cloud an attached service account.
• Least privilege: grant only the actions and resources needed.

import json

policy = {
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Action": ["s3:GetObject", "s3:PutObject"],
        "Resource": "arn:aws:s3:::acme-invoices/uploads/*",
    }],
}
print(json.dumps(policy, indent=2))
stmt = policy["Statement"][0]
print(f"allows {len(stmt['Action'])} actions on objects under {stmt['Resource'].split(':::')[1]}")

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::acme-invoices/uploads/*"
    }
  ]
}
allows 2 actions on objects under acme-invoices/uploads/*