We are trying to convince folks in our company to grant developers full privileges to all services in "dev" account (current policy does not allow developers to create anything in our AWS account, because "security").
Folks say we might grant you full privileges to certain services e.g. S3, but some services (specifically IAM) will be off limits. Argument is users would be able to grant themselves all kind of permissions if they have read/write access to IAM service in our account.
In following scenario:
- There are two S3 buckets (
s2) in an AWS account.
kashyapis granted full control over
s1, but not
s2(se he can't see/read/write/access/manage
kashyapis granted full control over IAM service.
kashyapgrant himself access to
s2by doing something in IAM?
kashyapcreate a new IAM user that has access to
- If answer to either 1 or 2 is yes, then is there a way to prevent it other than revoking all IAM privileges of
kashyap? Someone suggested Cloud Custodian
Note that S3 is just an example and I know one could work around this using S3 policy. My question is more broad and could be applied to any resource like EC2 instance, Lambda function or Dynamo DB table/instance.
and a few more..