Lion Cipher Lab
Cap privileges safely with an IAM permissions boundary
- Cloud Security
- Intermediate
- ~45 min
- Free · no account required
Why it matters
The most dangerous assumption in cloud IAM is that the permissions policy you attached is the whole story. It is not. An identity's permissions policy says what it is ALLOWED to try; a permissions boundary says the MAXIMUM it can ever actually do — and the real, effective permission is the INTERSECTION of the two. A boundary grants nothing on its own; it only caps. That one idea unlocks the single most important delegation pattern in AWS: safely letting a 'team admin' create roles and users for their squad WITHOUT letting them (or the principals they create) escalate to full account takeover.…
What you'll learn
- what an IAM permissions boundary is: a managed policy that sets the MAXIMUM permissions an entity can have
- why effective permissions are the INTERSECTION of an identity's permissions policies AND its boundary
- proving the cap: attaching AdministratorAccess to a role and watching calls outside the boundary get AccessDenied
- creating a boundary policy and attaching it to a role at creation time with --permissions-boundary
- assuming a role via a named CLI profile (role_arn + source_profile) with no long-lived keys
- reading effective permissions with the IAM Policy Simulator (simulate-principal-policy)
- the delegation pattern: the iam:PermissionsBoundary condition key that forces every role a delegated admin creates to carry the boundary
- choosing between a permissions boundary, an SCP, a scoped identity policy, and a session policy — the full 'who wins' evaluation
Steps in this lab
- The one idea: a boundary is a ceiling, not a grant
- Who wins: boundary vs SCP vs identity policy vs session policy
- Safety setup: confirm your identity and capture your account id
- Create the boundary policy (the ceiling: S3 + CloudWatch only)
- Create a throwaway role with AdministratorAccess AND the boundary
- Assume the role through a named profile (no long-lived keys)
- Prove the cap: AdministratorAccess attached, yet DENIED
- Confirm it offline with the IAM Policy Simulator
- The killer use case: safe delegation with iam:PermissionsBoundary
- Clean up: delete every test resource
- When a boundary is the right tool — and when it is not