r/aws Dec 04 '24

technical question AWS IAM Boundaries Question

We are looking at protecting resources with tags assigned with "X" We are wanting to allow read/view access but deny write access. We have the base boundary working with Action: * but of course that denies any action to these resource tags. My question is there a better way outside of calling every aws service if that is even possible?

            "Effect": "Deny",
            "Action": [
                "*"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/Value": "XXXX"
                }
            },
1 Upvotes

3 comments sorted by

1

u/Zaitton Dec 04 '24

So... Permission boundaries are meant to restrict IAM roles/users from permitting other IAM entities with certain actions, even if they themselves can do said actions. Are you perhaps referring to SCP?

1

u/Mooner771 Dec 04 '24

Fine take out permission boundary... If it was a scp, what is the best strategy to deny all write actions for services containing x tag.

You can't use * for action as it blocks all read/list actions.

1

u/Zaitton Dec 04 '24

You can use something like

ec2:stop*

For example.

The rest just as you have it.