Noam Dahan
LightNews LightNews
banner
noamdahan.bsky.social
Noam Dahan
@noamdahan.bsky.social
89 followers 66 following 15 posts
Cloud security researcher at CrowdStrike, European Universities Debating Champion (for my sins). My 5th grade teacher said I was disruptive.
Posts Replies Media Videos
noamdahan.bsky.social
RCPs apply to every request directed at a resource in the account. So we can implement the policy we wanted.

Not only that, we can set trust boundaries for IAM roles (e.g. only directly exempted accounts can AssumeRole into our org's identities). More here:
github.com/aws-samples/...

/fin
VS Code screenshot: { "Version": "2012-10-17", "Statement": [ { "Sid": "EnforceOrgIdentities", "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": [ "arn:aws:s3:::AwesomeCats-af4v81b2", "arn:aws:s3:::AwesomeCats-af4v81b2/*" ], "Condition": { "StringNotEqualsIfExists": { "aws:PrincipalOrgID": "<my-org-id>", "aws:PrincipalAccount": [ "<load-balancing-account-id>", "<fin-space-account-id>", "<third-party-account-a>", "<third-party-account-b>" ], "aws:ResourceTag/dp:exclude:identity": "true" }, "BoolIfExists": { "aws:PrincipalIsAWSService": "false" } } } ] }
November 15, 2024 at 11:02 AM
noamdahan.bsky.social
RCPs (Resource Control Policies) launched in AWS, yay!
I imagine the reactions are generally divided into three:
1. This is awesome! We've been waiting for this for a long time! (yes you're very itk see you at fwd:cloudsec)
2. Cool! Love it! What are they?
3. Didn't SCPs already solve that? 🤔
🧵
A complex flowchart diagram illustrating AWS Permission Evaluation with Resource Control Policies (RCPs). The chart is divided into several sections, each representing different stages of the permission evaluation process. The flowchart begins with "Deny evaluation" at the top, leading to a series of decision points represented by diamond shapes. These decision points evaluate various conditions, such as the presence of explicit Deny policies, organization resource control policies (RCP), and service control policies (SCP). The chart then branches into sections for "Resource-based policies" and "Identity-based policies". Each section contains multiple decision points and paths, leading to potential outcomes of "Allow" or "Deny (implicit deny)". The Resource-based policies section includes checks for session, role, and account permissions of the calling principal. The Identity-based policies section evaluates identity-based policies and permissions boundaries. At the bottom of the chart, there's a section for "Session policies" which includes checks for federated users and session policies.
November 15, 2024 at 11:02 AM