Restricting User Privileges and Revoking Session Permissions
Passionate DevOps/Cloud/Database Architect with a proven track record in automation, cloud optimization, and Database management. Experienced in IT , I specialize in designing and implementing CI/CD pipelines, automating deployments, and leveraging cloud technologies to build scalable, secure, and high-performing infrastructures. Seeking opportunities to drive innovation and efficiency in modern software development environments.
In this practical guide, we will explore how to restrict user privileges to prevent privilege escalation and how to revoke session privileges when necessary.
Restricting User Privileges
Creating a User with Restricted Access
To demonstrate privilege restriction, we create a user with Administrator Access but enforce a permissions boundary that limits access to S3 Read-Only permissions. This setup ensures that even with administrative privileges, the user cannot perform actions beyond the defined scope.
Verifying Restricted Access
After the user logs into the system, despite having an Administrator policy attached, they are unable to view or access the EC2 Console due to the permissions boundary.
Removing the Permission Boundary
If we remove the permissions boundary, the user will regain full access as per the Administrator policy. This highlights the importance of using permission boundaries to restrict user access and prevent unintended privilege escalation.
Revoking Session Privileges
There are instances where revoking session privileges becomes necessary, such as when an access key is compromised. In this example, we demonstrate how an unauthorized session can be revoked to prevent misuse.
Simulating a Compromised Access Scenario
We create an IAM Role with S3 permissions.
The role’s trust policy allows assumption by EC2 instances and by the role itself.
The role is assigned to an EC2 instance, from which we generate a session token using the AWS STS (Security Token Service).
Using the generated session token, we configure access on a personal laptop, allowing external access to S3. At this stage, the role’s privileges are accessible from an external device, demonstrating a potential security risk.
Revoking the Session Privileges
To prevent further unauthorized access, we revoke the session privileges, rendering the session token invalid.
Verifying Session Revocation
Once the session is revoked, any attempt to use the previously generated session token results in an Access Denied error. This confirms that the session has been successfully terminated, mitigating potential security risks.
Key Takeaways
Permission boundaries can effectively restrict user access, even when high-privilege policies are assigned.
IAM Role assumptions should be closely monitored to prevent unauthorized access.
Revoking session privileges is an essential security measure when credentials are compromised.
By implementing these best practices, organizations can minimize security risks and enforce strict access controls on AWS resources.