The Power of AWS Tags (Advanced IAM Session)
summary
Claims a concrete, deployable system: a tag‑based control plane that enforces ABAC and a two‑person approval flow on AWS using SCPs, IAM tags and a Lambda TTL sweeper. The guard denies deletion of S3 buckets or RDS clusters unless a 2PA ticket is present, requires identity‑brokered source identities, and scopes tag edits by prefix via control tags (prefix swcdl). The team runs it in production for over two years with ~10 admins and an automated ticket cleanup every 30 minutes.
AI-written summary · about
chapters (16)
- 0:00AWS tags and ABAC intro
- 3:04AWS IAM tags and ABAC basics
- 5:14ABAC issues in AWS
- 7:43Control Tags for scalable ABAC
- 10:14SCP with Control Tags
- 11:40Demo: admin approval for deletion
- 12:45Two-person approval ticket anatomy
- 13:50Two-person approval control plane
- 16:23Ticket expiration in Lambda
- 17:06SCP for approval tickets
- 18:32Granular approvals with GPA sales
- 19:15Seals for sensitive resources
- 20:19Two-person approval trust relay
- 21:23Approvals for Kubernetes and Vault
- 22:29Attack simulation demo
- 25:01Summary and Control Tags
related talks
24mThe Power of AWS Tags
31mScale Permissions Management With Attribute-based Access Control
21mSecuring hundreds of AWS accounts for streamlined governance
38mFinOps and Tag Strategy on AWS
59mProvably secure authorization
23mGetting started with identity on AWS
58mCreate enterprise-wide preventive guardrails
27mIntroduction to AWS Security