From the course: Complete Guide to AWS Security and Compliance Management

Unlock the full course today

Join today to access over 24,700 courses taught by industry experts.

Illustrating access restrictions

Illustrating access restrictions - Amazon Web Services (AWS) Tutorial

From the course: Complete Guide to AWS Security and Compliance Management

Start my 1-month free trial Buy for my team

Illustrating access restrictions

“

- [Instructor] As you use IAM to grant access to resources, there may be some actions you want to implicitly deny for all IAM users in your account. Consider the following scenario, which I've set up in my account. Recall that we have a user, Madeline. Per the Super Admin Challenge, she can now assume the Super Admin role. Recall that this role contains the AWS Managed Policy for Administrator Access. Looking at the contents of this policy, recall that it allows any action on any resource. With this broad level of access, we might want to put reasonable restrictions in place to support separation of duties. For example, CloudTrail is where audit logs of API activity is stored. As such, it's a good idea to inhibit the ability to delete CloudTrail artifacts. The Cloud Hardware Security Module is a means for storing cryptographic keys. If you decide to use the key management service instead of cloud HSM, you may want to inhibit the ability to use this service. Clearly, you are using IAM…

Contents