Trying to give IAM user rights to create and assign roles, but limit the type of policies available

user_13622435 0
Viewed 3377

I'm trying to give a user the rights to create Roles (since I'm not providing rights to create Access Keys).

I have figured out a Policy to allow the user to create and assign Roles. The issue I have is that right now, the user can create a role with the Policy of "AdministratorAccess" even though they are not Administrator. Is there a way to deny certain policies in the list of options?

Below is the policy done via the wizard provided.

Thanks,

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": [
        "iam:CreateInstanceProfile",
        "iam:UpdateAssumeRolePolicy",
        "iam:ListRoleTags",
        "iam:UntagRole",
        "iam:PutRolePermissionsBoundary",
        "iam:TagRole",
        "iam:RemoveRoleFromInstanceProfile",
        "iam:CreateRole",
        "iam:AttachRolePolicy",
        "iam:PutRolePolicy",
        "iam:ListInstanceProfilesForRole",
        "iam:PassRole",
        "iam:DetachRolePolicy",
        "iam:DeleteRolePolicy",
        "iam:ListAttachedRolePolicies",
        "iam:ListRolePolicies",
        "iam:ListPolicies",
        "iam:GetRole",
        "iam:ListRoles",
        "iam:DeleteRole",
        "iam:UpdateRoleDescription",
        "iam:CreateServiceLinkedRole",
        "iam:UpdateRole",
        "iam:DeleteServiceLinkedRole",
        "iam:GetRolePolicy"
      ],
      "Resource": "*",
      "Condition": {
        "BoolIfExists": {
          "aws:MultiFactorAuthPresent": "true"
        }
      }
    }
  ]
}

EDIT: 26/6/20 I tried to use Permission Boundaries as suggested, but perhaps my understanding is still insufficient. I made a new policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyAdmin",
            "Effect": "Deny",
            "Action": [
                "iam:*"
            ],
            "Resource": "*",
            "Condition": {
                "ArnEquals": {
                    "iam:PolicyArn": [
                        "arn:aws:iam::aws:policy/AdministratorAccess"
                    ]
                }
            }
        }
    ]
}

I would think that would mean Deny any/all iam actions when it concerns the AdministratorAccess Policy. However, the result is that all role assignments/creation are denied even when the policy being attached is NOT AdministratorAccess. However, if I setup a policy and add a Condition of ArnNotEquals the AdministratorAccess - then I seem to be able to do what I want(just using it as a policy, not as a Boundary)

Based on what I have seen, Permissions Boundary is probably the right way to go, but I cannot quite get it yet so I'm hesitant to mark it as "Correct Answer".

amazon-iam amazon-web-services
2 Answers

You can use AWS IAM Permissions Boundaries: Permissions Boundaries for IAM Entities - AWS Identity and Access Management

“A permissions boundary is an advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity. An entity's permissions boundary allows it to perform only the actions that are allowed by both its identity-based policies and its permissions boundaries.“

Here’s a step-by-step introduction on the AWS Security Blog: Delegate permission management to developers by using IAM permissions boundaries | AWS Security Blog

user_1586680

So using directions from John Rotenstein and finally realizing where I went wrong the way to get what I want is to add the following Permissions Boundary to the user:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "BoundaryAllowAllNotAdminAccess",
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "ArnNotEquals": {
                    "iam:PolicyArn": [
                        "arn:aws:iam::aws:policy/AdministratorAccess"
                    ]
                }
            }
        }
    ]
}

Where I went wrong was thinking that I need to Deny, but the Boundary is an AND restraint so I can allow all as long as it is not AdministratorAccess, then the other policies will give the actual actions/resources and AWS will allow as long as it doesn't use the AdministratorAccess.

user_136224350
Related