Scaling Identity: Implementing Permissions Boundaries and Delegated Administration

This lab focuses on implementing identity and access management at scale using Permissions Boundaries and Least Privilege principles. You will learn how to delegate administrative tasks to "Junior Admins" without allowing them to escalate their own privileges or bypass organizational security controls.

[!WARNING] Performing these actions will create IAM resources. Ensure you follow the teardown instructions at the end to maintain a clean environment and avoid security risks.

Prerequisites

An AWS Account with Administrator access.
AWS CLI installed and configured with credentials for the Admin user.
Basic knowledge of IAM JSON policy structure.

Learning Objectives

Create and enforce IAM Permissions Boundaries to limit maximum allowable permissions.
Design policies that adhere to the principle of Least Privilege.
Understand the policy evaluation logic when Service Control Policies (SCPs) and Boundaries intersect.
Delegate user creation to a restricted administrative role.

Architecture Overview

The following diagram illustrates how the Permissions Boundary acts as a "guardrail" that restricts the effective permissions of the Junior Admin, regardless of the Identity-based policies they possess.

Loading Diagram...

Figure 1 — Mermaid diagram

Step-by-Step Instructions

Step 1: Create the Permissions Boundary Policy

A Permissions Boundary is a managed policy that sets the maximum permissions that an identity-based policy can grant to an IAM entity.

bash

# Create a JSON file for the boundary
cat <<EOF > boundary-policy.json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowS3AndCloudWatch",
            "Effect": "Allow",
            "Action": [
                "s3:*",
                "cloudwatch:*",
                "logs:*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "DenyIAMRestricted",
            "Effect": "Deny",
            "Action": [
                "iam:DeletePolicy",
                "iam:UpdateAssumeRolePolicy"
            ],
            "Resource": "*"
        }
    ]
}
EOF

# Create the policy in AWS
aws iam create-policy --policy-name GlobalGuardrailBoundary --policy-document file://boundary-policy.json

▶Console alternative

Navigate to IAM > Policies > Create policy.
Paste the JSON from above.
Name it GlobalGuardrailBoundary and click Create.

Step 2: Create a Junior Admin Role with the Boundary

Now we create a role that has AdministratorAccess but is constrained by the boundary we just created.

bash

# Create trust policy
cat <<EOF > trust-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::<YOUR_ACCOUNT_ID>:root" },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

# Create the role with the boundary attached
aws iam create-role --role-name JuniorAdminRole \
    --assume-role-policy-document file://trust-policy.json \
    --permissions-boundary arn:aws:iam::<YOUR_ACCOUNT_ID>:policy/GlobalGuardrailBoundary

# Attach full Admin power (Identity-based)
aws iam attach-role-policy --role-name JuniorAdminRole --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

[!IMPORTANT] Note that even though we attached AdministratorAccess, the role will only be able to perform S3 and CloudWatch actions because of the intersection with the boundary.

Step 3: Test Effective Permissions

To see the boundary in action, attempt to perform an action allowed by AdministratorAccess but denied/not-allowed by the Boundary (e.g., creating an EC2 instance).

bash

# Assume the role (you will need to configure a profile or use export)
# For simplicity, we check the policy simulator or try a CLI command if you have configured the profile
aws ec2 describe-instances --profile junior-admin

Expected Result: An error occurred (AccessDenied) when calling the DescribeInstances operation.

Checkpoints

Checkpoint	Action	Expected Result
Boundary Creation	Run `aws iam get-policy --policy-arn ...`	Returns the JSON of your `GlobalGuardrailBoundary`.
Role Constraint	View `JuniorAdminRole` in the IAM Console.	Under "Permissions boundary", you should see the policy attached.
Access Denied	Try `aws s3 ls` vs `aws ec2 describe-vpcs`.	S3 should succeed; EC2 should fail with Access Denied.

Concept Review

Understanding the "Policy Intersection" is critical for the DevOps Professional exam. The effective permission is the overlap where all applicable policies agree on an "Allow."

Compiling TikZ diagram…

⏳

Running TeX engine…

This may take a few seconds

Figure 2 — TikZ diagram

Comparison: SCP vs. Permissions Boundary

Feature	Service Control Policy (SCP)	Permissions Boundary
Scope	Entire AWS Account or OU	Specific IAM User or Role
Usage	Global guardrails (e.g., Deny Region)	Delegated Admin (e.g., Limit Junior Admins)
Who applies it?	Management Account (AWS Organizations)	Local Admin within the account
Overridable?	No - Root user is also affected	No - User cannot remove their own boundary

Troubleshooting

Error	Cause	Solution
`EntityAlreadyExists`	Resource names are already in use.	Use a different suffix (e.g., `JuniorAdminRole-V2`).
`MalformedPolicyDocument`	Invalid JSON syntax.	Check for missing commas or quotes in your `.json` files.
`LimitExceeded`	Too many policies or roles.	Delete old unused IAM resources.

Stretch Challenge

Credential Rotation Automation: Use AWS Secrets Manager to store a database credential and configure a Lambda function to rotate it every 30 days. Attach a policy to your JuniorAdminRole allowing it to GetSecretValue only for secrets tagged with Project: Lab.

Cost Estimate

IAM: $0.00 (IAM is a global free service).
AWS Secrets Manager (Challenge): $0.40 per secret per month + $0.05 per 10,000 API calls.
Total Estimated Cost: Virtually free if you stick to IAM.

Clean-Up / Teardown

To avoid clutter and security risks, delete the resources in this exact order:

bash

# 1. Detach the Managed Policy from the Role
aws iam detach-role-policy --role-name JuniorAdminRole --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

# 2. Remove the Permissions Boundary
aws iam delete-role-permissions-boundary --role-name JuniorAdminRole

# 3. Delete the Role
aws iam delete-role --role-name JuniorAdminRole

# 4. Delete the Boundary Policy
aws iam delete-policy --policy-arn arn:aws:iam::<YOUR_ACCOUNT_ID>:policy/GlobalGuardrailBoundary

# 5. Clean up local files
rm boundary-policy.json trust-policy.json

Scaling Identity: Implementing Permissions Boundaries and Delegated Administration

[!WARNING] Performing these actions will create IAM resources. Ensure you follow the teardown instructions at the end to maintain a clean environment and avoid security risks.

Prerequisites

An AWS Account with Administrator access.
AWS CLI installed and configured with credentials for the Admin user.
Basic knowledge of IAM JSON policy structure.

Learning Objectives

Create and enforce IAM Permissions Boundaries to limit maximum allowable permissions.
Design policies that adhere to the principle of Least Privilege.
Understand the policy evaluation logic when Service Control Policies (SCPs) and Boundaries intersect.
Delegate user creation to a restricted administrative role.

Architecture Overview

Loading Diagram...

Figure 1 — Mermaid diagram

Step-by-Step Instructions

Step 1: Create the Permissions Boundary Policy

A Permissions Boundary is a managed policy that sets the maximum permissions that an identity-based policy can grant to an IAM entity.

bash

# Create a JSON file for the boundary
cat <<EOF > boundary-policy.json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowS3AndCloudWatch",
            "Effect": "Allow",
            "Action": [
                "s3:*",
                "cloudwatch:*",
                "logs:*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "DenyIAMRestricted",
            "Effect": "Deny",
            "Action": [
                "iam:DeletePolicy",
                "iam:UpdateAssumeRolePolicy"
            ],
            "Resource": "*"
        }
    ]
}
EOF

# Create the policy in AWS
aws iam create-policy --policy-name GlobalGuardrailBoundary --policy-document file://boundary-policy.json

▶Console alternative

Navigate to IAM > Policies > Create policy.
Paste the JSON from above.
Name it GlobalGuardrailBoundary and click Create.

Step 2: Create a Junior Admin Role with the Boundary

Now we create a role that has AdministratorAccess but is constrained by the boundary we just created.

bash

# Create trust policy
cat <<EOF > trust-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::<YOUR_ACCOUNT_ID>:root" },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

# Create the role with the boundary attached
aws iam create-role --role-name JuniorAdminRole \
    --assume-role-policy-document file://trust-policy.json \
    --permissions-boundary arn:aws:iam::<YOUR_ACCOUNT_ID>:policy/GlobalGuardrailBoundary

# Attach full Admin power (Identity-based)
aws iam attach-role-policy --role-name JuniorAdminRole --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

[!IMPORTANT] Note that even though we attached AdministratorAccess, the role will only be able to perform S3 and CloudWatch actions because of the intersection with the boundary.

Step 3: Test Effective Permissions

To see the boundary in action, attempt to perform an action allowed by AdministratorAccess but denied/not-allowed by the Boundary (e.g., creating an EC2 instance).

bash

# Assume the role (you will need to configure a profile or use export)
# For simplicity, we check the policy simulator or try a CLI command if you have configured the profile
aws ec2 describe-instances --profile junior-admin

Expected Result: An error occurred (AccessDenied) when calling the DescribeInstances operation.

Checkpoints

Checkpoint	Action	Expected Result
Boundary Creation	Run `aws iam get-policy --policy-arn ...`	Returns the JSON of your `GlobalGuardrailBoundary`.
Role Constraint	View `JuniorAdminRole` in the IAM Console.	Under "Permissions boundary", you should see the policy attached.
Access Denied	Try `aws s3 ls` vs `aws ec2 describe-vpcs`.	S3 should succeed; EC2 should fail with Access Denied.

Concept Review

Understanding the "Policy Intersection" is critical for the DevOps Professional exam. The effective permission is the overlap where all applicable policies agree on an "Allow."

Compiling TikZ diagram…

⏳

Running TeX engine…

This may take a few seconds

Figure 2 — TikZ diagram

Comparison: SCP vs. Permissions Boundary

Feature	Service Control Policy (SCP)	Permissions Boundary
Scope	Entire AWS Account or OU	Specific IAM User or Role
Usage	Global guardrails (e.g., Deny Region)	Delegated Admin (e.g., Limit Junior Admins)
Who applies it?	Management Account (AWS Organizations)	Local Admin within the account
Overridable?	No - Root user is also affected	No - User cannot remove their own boundary

Troubleshooting

Error	Cause	Solution
`EntityAlreadyExists`	Resource names are already in use.	Use a different suffix (e.g., `JuniorAdminRole-V2`).
`MalformedPolicyDocument`	Invalid JSON syntax.	Check for missing commas or quotes in your `.json` files.
`LimitExceeded`	Too many policies or roles.	Delete old unused IAM resources.

Stretch Challenge

Cost Estimate

IAM: $0.00 (IAM is a global free service).
AWS Secrets Manager (Challenge): $0.40 per secret per month + $0.05 per 10,000 API calls.
Total Estimated Cost: Virtually free if you stick to IAM.

Clean-Up / Teardown

To avoid clutter and security risks, delete the resources in this exact order:

bash

# 1. Detach the Managed Policy from the Role
aws iam detach-role-policy --role-name JuniorAdminRole --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

# 2. Remove the Permissions Boundary
aws iam delete-role-permissions-boundary --role-name JuniorAdminRole

# 3. Delete the Role
aws iam delete-role --role-name JuniorAdminRole

# 4. Delete the Boundary Policy
aws iam delete-policy --policy-arn arn:aws:iam::<YOUR_ACCOUNT_ID>:policy/GlobalGuardrailBoundary

# 5. Clean up local files
rm boundary-policy.json trust-policy.json