Assigning permissions directly to users is difficult to manage and becomes problematic as organizations scale:
• Initial Configuration Issues
• Scaling Problems
• Job Function Alignment: Permissions in a group can be based on job functions • Inheritance: All users in the group inherit the permissions assigned to the group • Simplified Management: Single policy changes affect all group members
• Add users to groups or remove them from groups easily • A user can belong to multiple groups • Groups cannot belong to other groups (no nesting) • Groups can be granted permissions using access control policies • Groups do not have security credentials and cannot access web services directly
IAM groups are collections of IAM users that make it easier to manage permissions for multiple users instead of managing permissions for each individual user separately.
When creating groups that reflect job roles:
• Administrators Group: Li and Paulo
• Developers Group: Mateo, Shirley, and Sofia
• Test Group: Ana, Zhang, and Jane
When Ana transitions from testing to development:
When both user policies and group policies apply to the same user, specific rules govern access:
• Explicit Deny Override: User policies with explicit denies override group policy allows • Additive Permissions: Permissions from multiple sources combine, but denies take precedence
Example Scenario: Zhang has both user policy and group membership
Results:
• Policy Maintenance: Must update multiple policies when new resources are added • Resource Specification: Policies require listing each individual resource • Time-Consuming Updates: Modifications needed across multiple policies for role changes
Authorization strategy that defines permissions based on attributes: • Attributes: Key or key-value pairs • AWS Implementation: Uses tags as attributes • Application: Tags can apply to IAM resources (users/roles) and AWS resources
• Flexibility: More flexible than policies requiring individual resource listing • Granular Permissions: Enables fine-grained permissions without updating for every new user or resource • Scalability: Highly scalable approach to access control • Auditability: Fully auditable access patterns
Resource metadata consisting of key/value pairs: • User-Defined: Customers can create custom tags • Cross-Account: Tags can apply across AWS accounts and IAM users/roles • API Integration: Many AWS API operations return tag keys and values • Multiple Uses: Billing, filtered views, and access control
Example Tags:
Tag Limitations:
Development Team Setup
Attributes for Roles:
Resource Tagging
Resource Tags:
Using ABAC, one policy can handle permissions for multiple roles and resources, significantly reducing administrative overhead compared to traditional RBAC approaches.
Managing permissions effectively requires moving beyond individual user policies to group-based and attribute-based approaches. IAM groups provide immediate benefits for role-based access, while ABAC offers the most scalable solution for complex, dynamic environments with frequent resource and user changes.