Demo Permission Boundaries

In this tutorial, we’ll demonstrate how to enforce the principle of least privilege in AWS IAM by using permission boundaries. You’ll learn how to restrict a new user’s effective permissions so that they can only list S3 buckets without gaining full access.

1. Identify the Target S3 Bucket

First, open the Amazon S3 Management Console. Filter your buckets by the prefix “Company1” and locate company1-logs, which stores daily logs used by your development team.

2. Review Customer-Managed Policies

Next, navigate to the IAM console and filter customer-managed policies by “company1.” You should see:

3. Inspect the Full-Access Logs Policy

Click on Company1-Logs-Policy to view its JSON document. This policy grants any principal full control over the company1-logs bucket.

Currently, this policy is attached to the Developers group. All members—like John—inherit full S3 permissions on company1-logs.

4. Scenario: Hiring a New Intern

We’ve hired an intern, Sara, but we want to limit her permissions to bucket listing only. Without adjustments, adding her to the Developers group would grant full S3 access.

1. In the IAM console, click Create User.
2. Enter Sara-intern as the username.
3. Enable AWS Management Console access, generate a password, and require a reset on first login.
4. Add Sara-intern to the Developers group and complete the user creation.

5. Apply the Permissions Boundary

To restrict Sara’s permissions:

1. Open Sara-intern’s user summary and go to the Permissions tab.
2. Click Set permissions boundary.
3. Select Company1_List_S3_Buckets and save.

With Company1_List_S3_Buckets as Sara’s boundary, she can list bucket names (s3:ListAllMyBuckets) but cannot read, write, or delete any objects. This enforces least privilege for new users.

References

• AWS IAM Policies
• Using Permissions Boundaries for IAM Identities
• Amazon S3 Documentation