The power of the IAM permission boundary
The main idea behind a permission boundary is to provide a safety net. It's a set of access rights that an entity such as user, group, or organization can never exceed. A permission boundary on its own doesn't grant any permissions. The primary purpose of it is to restrict access. To understand permission boundaries, let's take a simple example, as follows:
- Create an IAM user using an
aws iam create-usercommand. We need to pass–-user-nameat the end of the command and then give the username—in this case,mypermuser. This will create an IAM user, as follows:$ aws iam create-user --user-name mypermuser
- In the next step, we will assign full permissions to the user by attaching an
AdministratorAccesspolicy. To attach this policy, we need to use anaws iam attach-user-policycommand and then pass the username,mypermuser, which is the same user we created in the previous step. The code for this can be seen...