CODEWITHSUNDEEP
amazon-web-servicesamazon-iam
hangc
hangc

Reputation: 5473

What is the purpose of 'resource' in an AWS resource policy?

As per title, what is the purpose of having the resource field when defining a resource policy when the resource policy is already going to be applied to a particular resource.

For example, in this aws tutorial, the following policy is defined an attached to a queue. What is the purpose of the resource field?

{
 "Version": "2008-10-17",
 "Id": "example-ID",
 "Statement": [
  {
   "Sid": "example-statement-ID",
   "Effect": "Allow",
   "Principal": {
     "AWS": "*"  
   },
   "Action": [
    "SQS:SendMessage"
   ],
   "Resource": "arn:aws:sqs:REGION:ACCOUNT-ID:QUEUENAMEHERE",
   "Condition": {
      "ArnLike": { "aws:SourceArn": "arn:aws:s3:*:*:bucket-name" }
   }
  }
 ]
}

Upvotes: 6

Views: 2319

Answers (2)

WaltDe
WaltDe

Reputation: 1832

S3 is a good example of where you need to include the resource statement in the policy. Let's say you want to have a upload location on S3 bucket. 

{
  "Version":"2012-10-17",
  "Statement":[
    {
      "Sid":"Upload",
      "Effect":"Allow",
      "Principal": "*",
      "Action":["s3:PutObject"],
      "Resource":["arn:aws:s3:::examplebucket/uploads/*"]
    }
  ]
}

In these cases you really don't want to default the Resource to the bucket as it could accidentally cause global access. It is better to make sure the user clearly understands what access is being allowed or denied.

But why make it required for resource policies where it isn't need like SQS? For this let's dive into how resource policies are used.

You can grant access to a resources 2 ways:

  1. Identity based policies for IAM principals (users and roles).
  2. Resource based policies

The important part to understand is how are resource polices used? Resource policies are actually used by IAM in the policy evaluation logic for authorization. To put it another way, resources are not responsible for the actual authorization that is left to IAM (Identity and Access Management).

Since IAM requires that every policy statement have a Resource or NotResource this means the service would need to add the resource when sending it to IAM if it was missing. So let us look at the implications from a design perspective of having the service add the resource if it is missing.

  1. The service no longer would need to just verify the policy is correct.
  2. If the resource is missing from the statement the service would need to update the policy before sending it to IAM.
  3. There is now the potential for two different versions of a resource policy. The one the user created for editing and the one sent to IAM.
  4. It increases the potential for user error and accidentally opening up access by attaching a policy to the wrong resource. If we modify the policy statement in the question drop the resource and condition statement we have a pretty open policy. This could easily be attached to the wrong resource especially from the CLI or terraform. 
  {
   "Sid": "example-statement-ID",
   "Effect": "Allow",
   "Principal": {
     "AWS": "*"  
   },
   "Action": [
    "*"
   ]
  }

Note I answered this from a general design perspective based on my understanding of how AWS implements access management. How AWS implemented the system might be a little different but I doubt it because policy evaluation logic really needs to be optimized for performance so it's better do to that in in one service, IAM, instead of in each service.

Hope that helps.

Extra reading if you are interested in the details of the Policy Evaluation Logic.

You can deny access 6 ways:

  1. Identity Policy
  2. Resource policies
  3. Organizational Polices if your account is part of an organization
  4. IAM permission boundaries if set
  5. Session Assumed Policy if used
  6. Implicitly if there was no allow policy

Here is the complete IAM policy evaluation logic workflow. The complete IAM policy evaluation

Upvotes: 6

Lamanus
Lamanus

Reputation: 13541

There is a Policy as you defined.

  • Policy applied resource : A, I don't know where you will apply this.
  • The resource in the policy : B, arn:aws:sqs:REGION:ACCOUNT-ID:QUEUENAMEHERE

Once you apply the polity to some service like ec2 instance that is A, then the instance only can do SQS:SendMessage through the resource B. A and B are totally different.

If you want to restrict the permission for the resource A that shouldn't access to other resources but can only access to the defined resources, then you have to define the resource such as B in the policy.

Your policy is only valid for that resource B and this is not the resource what you applied A.

Upvotes: 0

Related Questions