Cloud IAM Permission Overreach

Implement Least Privilege Policies:

// Bad: Overly permissive S3 policy
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:*",
    "Resource": "*"
  }]
}

// Good: Specific, limited permissions
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "s3:GetObject",
      "s3:ListBucket"
    ],
    "Resource": [
      "arn:aws:s3:::my-app-data-bucket",
      "arn:aws:s3:::my-app-data-bucket/*"
    ],
    "Condition": {
      "StringEquals": {
        "s3:ExistingObjectTag/Environment": "production"
      }
    }
  }]
}

Database Schema for IAM Management:

CREATE TABLE iam_role_definitions (
    id SERIAL PRIMARY KEY,
    role_name VARCHAR(255) UNIQUE NOT NULL,
    service_name VARCHAR(255) NOT NULL,
    environment VARCHAR(50) NOT NULL,
    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
    created_by VARCHAR(255) NOT NULL,
    approved_by VARCHAR(255),
    approval_date DATE
);

CREATE TABLE iam_permission_requirements (
    id SERIAL PRIMARY KEY,
    role_id INTEGER REFERENCES iam_role_definitions(id),
    aws_service VARCHAR(100) NOT NULL,
    actions TEXT[] NOT NULL,
    resources TEXT[] NOT NULL,
    conditions JSONB,
    justification TEXT NOT NULL,
    risk_assessment TEXT
);

CREATE TABLE iam_permission_reviews (
    id SERIAL PRIMARY KEY,
    role_id INTEGER REFERENCES iam_role_definitions(id),
    review_date DATE NOT NULL,
    reviewer VARCHAR(255) NOT NULL,
    findings TEXT,
    actions_taken TEXT,
    next_review_date DATE NOT NULL
);

Automated Permission Monitoring:

-- Track permission usage
CREATE TABLE iam_permission_usage (
    id BIGSERIAL PRIMARY KEY,
    role_arn VARCHAR(500),
    action VARCHAR(255),
    resource VARCHAR(500),
    used_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
    source_ip INET,
    user_agent TEXT
);

-- Identify unused permissions
CREATE VIEW unused_permissions AS
SELECT 
    pr.role_id,
    pr.aws_service,
    pr.actions,
    rd.role_name
FROM iam_permission_requirements pr
JOIN iam_role_definitions rd ON pr.role_id = rd.id
WHERE NOT EXISTS (
    SELECT 1 FROM iam_permission_usage pu
    WHERE pu.role_arn LIKE '%' || rd.role_name || '%'
    AND pu.action = ANY(pr.actions)
    AND pu.used_at > NOW() - INTERVAL '90 days'
);

Service-Specific Roles:

-- Enforce service isolation
ALTER TABLE iam_role_definitions 
ADD CONSTRAINT one_role_per_service_env 
UNIQUE (service_name, environment);

-- Prevent role sharing
CREATE OR REPLACE FUNCTION prevent_role_sharing()
RETURNS TRIGGER AS $
BEGIN
    IF EXISTS (
        SELECT 1 FROM iam_role_definitions
        WHERE role_name = NEW.role_name
        AND service_name != NEW.service_name
    ) THEN
        RAISE EXCEPTION 'Role % already assigned to different service', NEW.role_name;
    END IF;
    RETURN NEW;
END;
$ LANGUAGE plpgsql;

Additional Best Practices:

• Use AWS Organizations SCPs to prevent dangerous actions
• Implement mandatory MFA for all IAM operations
• Regular access reviews (quarterly minimum)
• Use AWS Access Analyzer for continuous monitoring
• Implement break-glass procedures for emergencies