Implements AWS IAM permission boundaries to enable security teams to delegate role creation to developers while enforcing least-privilege maximum permissions. Useful for secure IAM management in teams.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
IAM 权限边界（Permission Boundaries）是 AWS 的高级功能，用于设置基于身份的策略可以向 IAM 实体（用户或角色）授予的最大权限。它们使集中式安全团队能够安全地将 IAM 角色和策略创建委托给应用开发者，而不会有权限提升的风险。实体的有效权限是其基于身份的策略与权限边界的交集——即使身份策略授予了 `AdministratorAccess`，权限边界也会将其限制为仅允许的操作。
Implements AWS IAM permission boundaries to delegate role creation to developers while enforcing security team's maximum privilege limits.
Implements AWS IAM permission boundaries to delegate role creation to developers while enforcing maximum privilege limits from security teams. For compliance-aligned IAM setups.
Provides AWS CloudFormation patterns for IAM roles, policies, managed policies, permission boundaries, and trust relationships. Use for least-privilege access, cross-account assumptions, service roles, and reusable stacks.
Share bugs, ideas, or general feedback.
IAM 权限边界（Permission Boundaries）是 AWS 的高级功能，用于设置基于身份的策略可以向 IAM 实体（用户或角色）授予的最大权限。它们使集中式安全团队能够安全地将 IAM 角色和策略创建委托给应用开发者，而不会有权限提升的风险。实体的有效权限是其基于身份的策略与权限边界的交集——即使身份策略授予了 AdministratorAccess，权限边界也会将其限制为仅允许的操作。
基于身份的策略 权限边界
（角色能做什么） ∩ （角色可以做什么）
│ │
└──────────┬───────────────────┘
│
有效权限
（仅两个策略都允许的操作）
AWS 按以下顺序评估权限：
实体只有在所有适用的策略类型都允许时才能执行操作。
| 使用场景 | 描述 |
|---|---|
| 开发者委托 | 允许开发者创建 IAM 角色，但不能超出其边界范围 |
| 沙箱隔离 | 限制沙箱/开发账户中角色的操作范围 |
| 多租户工作负载 | 确保特定于租户的角色无法访问其他租户的资源 |
| CI/CD 流水线角色 | 将自动化角色限制在特定服务 |
创建一个定义最大允许权限的托管策略：
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowedServices",
"Effect": "Allow",
"Action": [
"s3:*",
"dynamodb:*",
"lambda:*",
"logs:*",
"cloudwatch:*",
"sqs:*",
"sns:*",
"events:*",
"states:*",
"xray:*",
"ec2:Describe*",
"ec2:CreateTags",
"sts:AssumeRole",
"kms:Decrypt",
"kms:GenerateDataKey",
"kms:DescribeKey",
"secretsmanager:GetSecretValue"
],
"Resource": "*"
},
{
"Sid": "AllowIAMPassRole",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam::*:role/app-*",
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"lambda.amazonaws.com",
"states.amazonaws.com"
]
}
}
},
{
"Sid": "DenyBoundaryDeletion",
"Effect": "Deny",
"Action": [
"iam:DeletePolicy",
"iam:DeletePolicyVersion",
"iam:CreatePolicyVersion"
],
"Resource": "arn:aws:iam::*:policy/DeveloperBoundary"
},
{
"Sid": "DenyBoundaryRemoval",
"Effect": "Deny",
"Action": [
"iam:DeleteUserPermissionsBoundary",
"iam:DeleteRolePermissionsBoundary"
],
"Resource": "*"
}
]
}
授予开发者创建 IAM 角色的能力，但必须附加边界：
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowCreateRoleWithBoundary",
"Effect": "Allow",
"Action": [
"iam:CreateRole",
"iam:AttachRolePolicy",
"iam:DetachRolePolicy",
"iam:PutRolePolicy",
"iam:DeleteRolePolicy"
],
"Resource": "arn:aws:iam::*:role/app-*",
"Condition": {
"StringEquals": {
"iam:PermissionsBoundary": "arn:aws:iam::*:policy/DeveloperBoundary"
}
}
},
{
"Sid": "AllowCreatePolicyScoped",
"Effect": "Allow",
"Action": [
"iam:CreatePolicy",
"iam:DeletePolicy",
"iam:CreatePolicyVersion",
"iam:DeletePolicyVersion"
],
"Resource": "arn:aws:iam::*:policy/app-*"
},
{
"Sid": "AllowViewIAM",
"Effect": "Allow",
"Action": [
"iam:Get*",
"iam:List*"
],
"Resource": "*"
}
]
}
# 创建边界策略
aws iam create-policy \
--policy-name DeveloperBoundary \
--policy-document file://developer-boundary.json
# 将边界附加到现有角色
aws iam put-role-permissions-boundary \
--role-name developer-role \
--permissions-boundary arn:aws:iam::123456789012:policy/DeveloperBoundary
# 创建带边界的新角色
aws iam create-role \
--role-name app-lambda-executor \
--assume-role-policy-document file://trust-policy.json \
--permissions-boundary arn:aws:iam::123456789012:policy/DeveloperBoundary
边界必须包含拒绝语句，防止开发者：
resource "aws_iam_policy" "developer_boundary" {
name = "DeveloperBoundary"
path = "/"
policy = file("${path.module}/policies/developer-boundary.json")
}
resource "aws_iam_role" "app_role" {
name = "app-lambda-executor"
assume_role_policy = data.aws_iam_policy_document.lambda_trust.json
permissions_boundary = aws_iam_policy.developer_boundary.arn
}
app-* 前缀）