CODEWITHSUNDEEP
amazon-web-servicessecurityamazon-iam
user6634768
user6634768

Reputation:

AWS IAM: How to prevent privilege elevation with IAM policies?

There is a policy attached to user/role which is allowed to create other policies and roles, but, for example, original role doesn't have permissions to do s3:PutObject. Is there any way I can prevent this role/user from creating another policy which allows s3:PutObject and elevating it's own permissions by that?

Upvotes: 0

Views: 620

Answers (1)

jarmod
jarmod

Reputation: 78653

If you grant users the ability to create policies and roles, then you trust them not to abuse it. Very few admins should have this ability.

The way to solve your case is for an uber-admin to create policies and roles, and for your user to be restricted to which policies/roles he can attach (see related article). You can also implement automation to validate the policies created by your uber-admins meet certain conditions.

Upvotes: 1

Related Questions