[ SRE_ARENA ]
← BACK TO ROADMAP
CLOUD IDENTITY (IAM)

Cloud Identity: The New Security Perimeter

DOWNLOADING CONCEPT: 1. IDENTITY IS THE NEW PERIMETER...
  • ↳In a traditional data center, security was based on a massive Firewall.
  • ↳If you were 'inside' the network, you were trusted.
  • ↳In the Cloud, there is no perimeter.
  • ↳Your database, your storage buckets, and your APIs all have public IP endpoints (internally or externally).
  • ↳Because network boundaries are fluid, Identity and Access Management (IAM) is your true security perimeter.
  • ↳Even if a hacker bypasses a firewall and gets onto an EC2 instance, if that instance has no IAM permissions, the hacker can do absolutely nothing.
▲ LIVE INCIDENTA developer complains they are getting an 'Access Denied' error when trying to upload a file to the prod-invoices S3 bucket. They show you their IAM policy, and it clearly has s3:* on *.
sre@arena:~/cloud-iam
sre@arena:~$ aws iam simulate-principal-policy --policy-source-arn arn:aws:iam::123456:user/dev --action-names s3:PutObject --resource-arns arn:aws:s3:::prod-invoices/file.pdf