AWS IAM — Identity & Access Management

IAM policies, roles, STS, permission boundaries a least privilege best practices.

Policy struktura

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject", "s3:ListBucket"],
    "Resource": ["arn:aws:s3:::my-bucket", "arn:aws:s3:::my-bucket/*"],
    "Condition": {"StringEquals": {"aws:RequestedRegion": "eu-west-1"}}
  }]
}

Permission Boundaries

Omezují maximální oprávnění role/user — i admin nemůže překročit boundary:

aws iam put-role-permission-boundary \
  --role-name dev-role \
  --permissions-boundary arn:aws:iam::123:policy/DevBoundary

STS AssumeRole

aws sts assume-role \
  --role-arn arn:aws:iam::987654321:role/CrossAccountRole \
  --role-session-name my-session

Vždy AssumeRole over long-lived credentials.

Best Practices

• Root — MFA, žádné API keys
• Least privilege — deny-all, přidávejte postupně
• IAM Access Analyzer — unused permissions
• SCPs — guardrails na Organization level