The principle of least privilege (PoLP) dictates that users, systems, and applications should only have the minimum permissions required to perform their tasks. This reduces the potential impact of security breaches and accidental actions by users and applications.
Why is Least Privilege Important?
- Enhanced Security: Limiting access minimizes the potential damage from a security breach, as a compromised account or system can only access what it needs.
- Compliance: Many regulatory frameworks require strict access controls, and PoLP helps meet these requirements.
- Operational Simplicity: Managing permissions becomes easier when you clearly understand what each user or system has and needs access to.
How to Implement Least Privilege in AWS:
IAM Policies:
- Create Specific Policies: Instead of granting broad permissions, create policies that allow only the necessary actions and resources.
- IAM Access Analyzer: Use this tool to identify unused or over-permissive permissions and guide you towards more restrictive policies.
- IAM Roles: Use roles to grant permissions to AWS services, allowing them to access resources on your behalf, but only with the necessary permissions.
When developing Application Execution Roles, restrict the resources and actions necessary for the application to perform its tasks. Avoid being overly permissive with wild cards and AWS-managed policies and roles.
Service Accounts:
- Dedicated Accounts: Use separate AWS accounts for different workloads or environments to further isolate access and permissions.
- Short-Term Credentials: Use short-term credentials (e.g., using STS) instead of long-term credentials to limit the duration of access.
At St. Thomas we utilize separate AWS Organizational accounts to separate functional areas, development, and production workloads. Logins via the Command Line and Web Console are also limited in duration.
AWS CloudTrail:
- Monitor Access: Use CloudTrail to audit user activity and identify potential over-permissive permissions.
CloudFormation:
- Template Control: Use CloudFormation templates to define and deploy resources and ensure that the templates grant only the necessary permissions.
AWS KMS:
- Encryption Context: Use encryption context in KMS to further restrict access to encrypted data.
Service Control Policies (SCPs):
- Org-Wide Control: Implement SCPs to enforce least privilege across your entire organization's AWS infrastructure.
IAM Permissions Boundaries:
- Restrict Permissions: Use IAM permissions boundaries to restrict the maximum permissions granted to an IAM user or role.
Depending on the organizational account, permission boundaries may need to be incorporated into any application execution roles you create.
Examples
- Scenario: A user needs to upload files to a specific S3 bucket.
- Least Privilege Implementation:
- Create an IAM policy allowing users to perform an
s3:PutObject within that specific bucket. (But not * or s3:deleteObject)
- Do not grant permissions to other S3 buckets or actions.
- Use IAM Access Analyzer to identify unused permissions and refine the policy.
- Scenario: An application has two Lambda functions. Lambda Function A writes entries to a DynamoDb table called UserGameSettings. Lambda Function B reads entries from the UserGameSettings DynamoDb table.
- Overly Permissive Implementation (BAD!):
- Least Privilege Implementation:
- Each Lambda function should have its own Execution Role, with policy statements that are scoped to only what it needs access to.
- Lambda Function A should have a separate role and policy that provides read/write access to the resource UserGameSettings:
- Sid: LambdaAccessToUserGameSettingsReadWrite
Action:
- dynamodb:GetItem
- dynamodb:Scan
- dynamodb:Query
- dynamodb:BatchGetItem
- dynamodb:PutItem
- dynamodb:UpdateItem
- dynamodb:BatchWriteItem
Effect: Allow
Resource: arn:aws:dynamodb:us-east-1:123456789012:table/UserGameSettings
- Lambda Function B should have a separate role and policy that provides read access to the resource UserGameSettings:
- Sid: LambdaAccessToUserGameSettingsRead
Action:
- dynamodb:GetItem
- dynamodb:Scan
- dynamodb:Query
- dynamodb:BatchGetItem
Effect: Allow
Resource: arn:aws:dynamodb:us-east-1:123456789012:table/UserGameSettings
Learn More