Who can do what: IAM

Two things went wrong. The key belonged to an identity that could do everything, and it was a long-lived key sitting in a file. IAM is how QuickCart fixes both.

IAM — Identity and Access Management — is the part of AWS that answers one question for every single request: is this caller allowed to do this, to this thing?

Every click in the console and every API call goes through it. There is no way around it.

Who can make a request

What they’re allowed to do

A policy is a JSON document listing what is allowed or denied. You attach it to a user, a group or a role. On its own, an identity can do nothing: every permission comes from a policy.

Here is the policy QuickCart’s API servers need. It lets them list and read menu photos in one bucket, and nothing else:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListMenuPhotos",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::quickcart-menu-photos-111122223333"
    },
    {
      "Sid": "ReadMenuPhotos",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::quickcart-menu-photos-111122223333/*"
    }
  ]
}

Two details catch everyone out:

• ListBucket acts on the bucket, so its ARN has no slash. GetObject acts on the files inside, so its ARN ends in /*. They are different resources, so they need different statements.
• S3 bucket ARNs have no region or account number in them — that’s why there are three colons in a row. Most other services do include them, like arn:aws:iam::111122223333:role/quickcart-api.

How AWS decides

Every request is checked in the same order:

Least privilege

Least privilege means giving each identity exactly the actions and resources it needs, and nothing more. The API reads menu photos, so it gets s3:GetObject on that one bucket — not s3:* on *.

It matters most when something goes wrong. If the API server is ever broken into, the attacker gets whatever the server was allowed to do. With least privilege, that is “read some pictures of burgers”. Without it, that is “delete every bucket”.

Roles instead of keys

An access key is a pair of strings — an ID starting AKIA and a secret — that works until someone deletes it. It can be copied, committed to git, or left on an old laptop, and it still works.

A role has no keys to leak. When something assumes the role, AWS hands it temporary credentials that expire, usually within hours, and renew automatically. A role has two policies, answering two separate questions:

This is the trust policy the console writes when you choose EC2 as the trusted service:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

There’s no Resource in a trust policy: it is attached to the role, so the resource is the role itself.

The root user

The root user can’t be limited by any IAM policy. So QuickCart does three things, once:

Below is the API server’s role. Pick a request, attach or detach statements, and check it. Try each request with only the first statement attached. Then attach the s3:* shortcut. Then attach the Deny.

What to notice: with only the least-privilege statement, reading the state file is denied without any Deny being written — that is the implicit deny doing its job. Attaching s3:* makes every request work, which is exactly why it’s tempting and exactly why it’s dangerous. And the Deny wins even when s3:* is attached.

Free — IAM itself costs nothing, and the policy simulator never touches a real bucket.

You’ll check your root user is protected, write QuickCart’s least-privilege policy, give it to a role, and then prove what the role can and can’t do. About 20 minutes.

Sign in as an IAM identity with administrator access, not as root. If you only have the root login so far, Set up your computer shows how to create an everyday admin identity first.

1. Check the root user is protected

   AWSIn the AWS console: IAM→Dashboard

   Look at the Security recommendations panel.

   You should see

   Green ticks for Root user has MFA and Root user has no active access keys. The exact wording may differ slightly.

   If either is missing, fix it before anything else. Sign in as root, open the account menu at the top right, choose Security credentials, and use Assign MFA device — an authenticator app on your phone is fine. On the same page, delete any root access keys under Access keys.

2. Create the least-privilege policy

   AWSIn the AWS console: IAM→Policies→Create policy

   In the Policy editor, switch from Visual to JSON. Delete what’s there and paste the policy from the idea, above:

   quickcart-menu-photos-read.jsonCopy

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "ListMenuPhotos",
         "Effect": "Allow",
         "Action": "s3:ListBucket",
         "Resource": "arn:aws:s3:::quickcart-menu-photos-111122223333"
       },
       {
         "Sid": "ReadMenuPhotos",
         "Effect": "Allow",
         "Action": "s3:GetObject",
         "Resource": "arn:aws:s3:::quickcart-menu-photos-111122223333/*"
       }
     ]
   }

   The bucket doesn’t need to exist for this lab. Choose Next.

   Field	Enter
   Policy name	quickcart-menu-photos-read
   Description	Read-only access to the menu photos bucket

   Choose Create policy.

   You should see

   A green banner: Policy quickcart-menu-photos-read created. It’s listed with Type: Customer managed — one you wrote, as opposed to the ones AWS provides.

3. Create a role that uses it

   AWSIn the AWS console: IAM→Roles→Create role

   Field	Enter
   Trusted entity type	AWS service
   Service or use case	EC2
   Use case	EC2 — the first option, “Allows EC2 instances to call AWS services on your behalf”

   Choose Next. In Permissions policies, search for quickcart-menu-photos-read and tick it. Choose Next.

   Field	Enter
   Role name	quickcart-menu-reader
   Description	QuickCart API servers: read menu photos

   Before you create it, look at Step 1: Select trusted entities on this page. It shows the trust policy, with "Service": "ec2.amazonaws.com" — the same as in the idea. Choose Create role.

   You should see

   Role quickcart-menu-reader created. Open it: the Permissions tab lists your one policy, and the Trust relationships tab lists the EC2 service.

4. Open the policy simulator

   AWSIn the AWS console: IAM→Dashboard→Tools→Policy simulator

   The Tools panel is on the right of the IAM dashboard. The simulator opens in a new tab. If you can’t see the link, type policy simulator into the console’s search bar.

   The simulator works out what a policy would allow without making any real request. Nothing is read, changed or charged.

   On the left, under Users, Groups, and Roles, change the drop-down to Roles and choose quickcart-menu-reader. Its policy appears, ticked.

5. Test reading a photo

   On the right:

   Field	Enter
   Select service	Amazon S3
   Select actions	tick GetObject and DeleteObject

   Expand GetObject in the list of actions and set its resource:

   Field	Enter
   Resource	arn:aws:s3:::quickcart-menu-photos-111122223333/burger.jpg

   Do the same for DeleteObject, with the same ARN. Then choose Run Simulation.

   You should see

   GetObject: allowed. DeleteObject: denied, with a note that it’s implicitly denied — no statement matched. Nobody wrote “don’t delete”; it simply wasn’t allowed.

6. Test a bucket it shouldn't touch

   Change the GetObject resource to the Terraform state bucket:

   Field	Enter
   Resource	arn:aws:s3:::quickcart-tfstate-111122223333/dev/terraform.tfstate

   Choose Run Simulation again.

   You should see

   GetObject: denied. Same action, different bucket. The role can read menu photos and nothing else — least privilege, proven.

7. Clean-up step: Clean up

   Nothing here costs money, but unused roles and policies are clutter that someone will one day be afraid to delete.

   AWSIn the AWS console: IAM→Roles→quickcart-menu-reader→Delete

   Type quickcart-menu-reader to confirm and choose Delete.

   AWSIn the AWS console: IAM→Policies→quickcart-menu-photos-read→Actions→Delete

   Type quickcart-menu-photos-read to confirm and choose Delete.

   You should see

   Neither the role nor the policy appears in its list. Close the simulator tab. Keep root’s MFA on for good.