How to Design IAM

ISDA - 9/7 - Minimum

Experiences
- Cloud Architect (2018+)
- OOBOX Group (2017+)
- ISDA (2016+)
- DevOps Engineer / SRE (2015+)
- Software Engineer (2011+)
Abilities
- Python
- Container
- Cloud Services
- CI / CD / CM

Who Am I?

+ Cloud Architect

+ System Architect

+ Database Administrator

+ Backend Engineer

+ DevOps Engineer

+ QA Engineer

+ Project Manager

+ Technical Leader

Current Job

AWS Policy Logic

image from https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html

AWS IAM Policy

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowServices",
"Effect": "Allow",
"Action": [
"s3:*",
"cloudwatch:*",
"ec2:*"
],
"Resource": "*"
},
{
"Sid": "AllowManageOwnPasswordAndAccessKeys",
"Effect": "Allow",
"Action": [
"iam:*AccessKey*",
"iam:ChangePassword",
"iam:GetUser",
"iam:*LoginProfile*"
],
"Resource": ["arn:aws:iam::*:user/${aws:username}"]
}
]
}

AWS S3 Policy

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets",
"s3:GetBucketLocation"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::bucket-name",
"Condition": {
"StringLike": {
"s3:prefix": [
"",
"home/",
"home/${aws:username}/*"
]
}
}
}
]
}