Scale Permissions Management With Attribute-based Access Control
summary
Shows ABAC implemented in AWS using session tags passed via the AssumeRole STS TagSession call, IAM policies that compare principal ResourceTag and request tags, and a second policy that enforces force tag on create. The demo actually starts/stops EC2 only when session tag equals instance tag, and denies creation when the RequestTag mismatches, then succeeds after correcting the tag — all policies work as written.
AI-written summary · about
chapters (16)
- 0:00Introduction to session
- 1:10IAM permissions recap
- 5:33Role-based access control
- 6:40Attribute-based access control
- 8:04ABAC with tags explained
- 10:13ABAC permission examples
- 11:19Session tags feature
- 13:31Applying ABAC steps
- 14:36Demo setup overview
- 16:23Console demo start
- 21:51EC2 tag enforcement demo
- 24:01Force tag on create demo
- 26:32Demo summary and benefits
- 27:35Demo policy breakdown
- 29:02ABAC best practices
- 30:07Closing and resources
related talks
26mThe Power of AWS Tags (Advanced IAM Session)
24mThe Power of AWS Tags
27mAccess management in 4D
25mGetting started with AWS Identity Services
23mGetting started with identity on AWS
57mA first-principles approach: AWS Identity and Access Management (IAM)
05mAWS On Air ft. AmazonS3 Bucket Owner Inforced setting
34mScaling access with AWS IAM Identity Center, feat.