"Administrators need to enable developers to move quickly when building applications on AWS while also controlling access to meet security needs. In this session, we demonstrate how administrators put permissions guardrails in place that enable them to grant broader access for their applications and developers. Then, we demonstrate how administrators can analyze activity to dial in access controls as applications and developers settle into common patterns. Finally, we show how to simulate permissions changes to understand and assess their impact. This session expects that participants are knowledgeable about IAM permission policies and AWS Organizations.

1. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Using analytics to set access controls
in AWS
Ujjwal Pugalia
Sr. Product Manager
AWS Identity
S D D 2 0 4

2. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
Access controls in AWS
Access control model that supports innovation
Tools to dial in access controls over time
Using analytics to set access controls confidently

3. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Related breakouts
Wednesday, June 26
FND314 - Managing and governing multi-account AWS environments
using AWS Organizations
11:00 a.m. – 12:00 p.m. | Level 0, Hall B2, Green
Wednesday, June 26
SDD314 - Enforcing security invariants with AWS Organizations
2:00 p.m. – 3:00 p.m. | Level 0, Hall B2, Red
Wednesday, June 26
SDD350 - Scale permissions management in AWS with attribute-based
access control
5:00 p.m. – 6:00 p.m. | Level 0, Hall B2, Red

4. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

5. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Setting access controls in AWS
Workforce users Permissions Resources
AWS account
AWS account
AWS account
Who Can access What

6. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Setting access controls in AWS
Workforce users Permissions Resources
AWS account
AWS account
AWS account
Who Can access What

7. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Types of access controls in AWS
Workforce users Permissions Resources
AWS account
AWS account
AWS account
Who Can access What

8. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Types of access controls in AWS
Workforce users Permissions Resources
AWS account
AWS account
AWS account
Who Can access What

9. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Shared ownership of access controls
Your job: Specification
Define which entities are allowed to perform which actions on
specific resources and under which conditions.

10. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Shared ownership of access controls
AWS’s job: Enforcement
For each request, the service or application evaluates the
permissions you defined to allow or deny access.
Your job: Specification
Define which entities are allowed to perform which actions on
specific resources and under which conditions.

11. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS is using data analysis to help simplify your
job of setting access controls on AWS.

12. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

13. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
The model
Permission
guardrails
General
workforce
permissions
Dial in
permissions
over time

14. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS tools for setting access controls
General
workforce
permissions
Dial in
permissions
over time
AWS Organizations AWS Identity and Access
Management (IAM) roles and
policies
IAM access
advisor
Permission
guardrails

15. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS tools for setting access controls at scale
General
workforce
permissions
Dial in
permissions
over time
AWS Organizations IAM access
advisor
Permission
guardrails
IAM roles and
policies

16. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Overview of AWS Organizations
Central governance
and management for
multiple AWS
accounts
Manage billing,
control access,
compliance, and
security, across your
AWS accounts
Automate account
creation, create
groups of accounts
based on business
need. Apply policies
for these groups.
Centrally manage and govern across AWS accounts

17. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS accounts and organizational units (OUs)
AWS accounts contain your AWS resources
Use resource permissions or roles to share across accounts
Group accounts in your organization into organizational units (OUs) to
simplify management of these accounts
Create multiple OUs within a single organization, and you can create
OUs within other OUs to form a hierarchical structure

18. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Permission guardrails
• Set permission guardrails by defining the maximum available permissions for IAM entities in an account
• Permissions guardrails are set using AWS Organizations and are called Service Control Policies (SCPs)
• Attach SCPs to the organization, OUs, and individual accounts
• SCPs attached to the root and OUs apply to all OUs and accounts inside of them

19. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
SCPs and IAM policies
• SCPs do not grant permission; they define the maximum available permissions for IAM entities in an
account
• IAM policies are general workforce permissions that you need to attach to IAM entities to grant them
permissions to a service or resource

20. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
SCPs and IAM policies
• SCPs do not grant permission; they define the maximum available permissions for IAM entities in an
account
• IAM Policies are general workforce permissions that you need to attach to IAM entities to grant them
permissions to a service or resource

21. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
SCPs and IAM policies
• SCPs do not grant permission; they define the maximum available permissions for IAM entities in an
account
• IAM policies are general workforce permissions that you need to attach to IAM entities to grant them
permissions to a service or resource

22. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
SCPs and IAM policies
• SCPs do not grant permission; they define the maximum available permissions for IAM entities in an
account
• IAM policies are general workforce permissions that you need to attach to IAM entities to grant them
permissions to a service or resource

23. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
SCPs and IAM policies
• SCPs do not grant permission; they define the maximum available permissions for IAM entities in an
account
• IAM policies are general workforce permissions that you need to attach to IAM entities to grant them
permissions to a service or resource

24. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
SCPs and IAM policies
• SCPs do not grant permission; they define the maximum available permissions for IAM entities in an
account
• IAM policies are general workforce permissions that you need to attach to IAM entities to grant them
permissions to a service or resource

25. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS tools for setting access controls at scale
General
workforce
permissions
Dial in
permissions
over time
AWS Organizations IAM access
advisor
Permission
guardrails
IAM roles and
policies

26. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS tools for setting access controls at scale
General
workforce
permissions
Dial in
permissions
over time
AWS Organizations IAM access
advisor
Permission
guardrails
IAM roles and
policies

27. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Brigid’s session
Wednesday, June 26
SDD350 - Scale permissions management in AWS with attribute-based access control
5:00 p.m. – 6:00 p.m. | Level 0, Hall B2, Red

28. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

29. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
The approach
Get started with access to a broader range of AWS services
Dial in permissions over time

30. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS tools for setting access controls at scale
General
workforce
permissions
Dial in
permissions
over time
AWS Organizations IAM access
advisor
Permission
guardrails
Service Control Policies (SCPs)
IAM roles and
policies

31. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS tools for setting access controls at scale
General
workforce
permissions
Dial in
permissions
over time
AWS Organizations IAM access
advisor
Permission
guardrails
Service Control Policies (SCPs)
IAM roles and
policies

32. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
IAM access advisor
• Provides service last accessed information for services allowed through
permissions
• Available for IAM entities (users, roles, groups, and IAM policies)
• Available through the IAM console or APIs
• Available for Organizations entities (organization root, OUs, accounts, and
SCPs)
New!

33. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Overview of dialing in permissions
Step 1: Determine services
last accessed
Step 2: Compare to existing
permissions
Step 3: Remove unused
permissions

34. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Step 1: Determine services last accessed

35. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Step 1: Determine services last accessed

36. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Step 2: Compare to existing permissions
Has access to
Amazon SNS
Amazon S3
AWS Lambda
Amazon API Gateway
AWS KMS
AWS CloudTrail
Amazon Cognito user pools
AWS Organizations
Alexa for Business
AWS Directory Service
AWS Certificate Manager (ACM)
Service last accessed in 60 days
Amazon SNS
Amazon S3
AWS Lambda
Amazon API Gateway
AWS KMS
AWS CloudTrail
Amazon Cognito user pools
AWS Organizations
Alexa for Business
AWS Directory Service
AWS Certificate Manager (ACM)

37. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Step 3: Remove unused permissions
Removed
permissions for
Organizations,
Alexa for Business,
Directory Service,
and ACM

38. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

39. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Access advisor with Organizations
• Confidently set permission guardrails i.e. SCPs using service last accessed
information for OUs and accounts
• Analyze existing SCPs to deny access to services that not used by IAM users
or roles within an account or OU
• Automate analyzing service last accessed information for your organization
using APIs
New!

40. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

41. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

42. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

43. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Recap
General
workforce
permissions
Dial in
permissions
over time
AWS Organizations IAM roles and policies IAM access
advisor
Permission
guardrails
Service Control Policies (SCPs)

44. Thank you!
© 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Ujjwal Pugalia
upugalia@amazon.com