ECS 3.6.2 Data Access Guide

ECS IAM and STS resources requests

The following procedure describes how the system evaluates the authorization requests on ECS IAM and STS resources within one namespace:

1. Deny evaluation - By default, all requests are denied (implicit deny). PEM evaluates all policies within the account that apply to the request. These include resource-based policies, permissions boundaries, role session policies, and identity-based policies. In all these policies, enforcement code looks for a Deny statement that applies to the request (explicit deny). If the code finds even one explicit deny that applies, the code returns a final decision of Deny. If there is no explicit deny, the evaluation continues.
2. Resource-based policies - If the requested resource has a resource-based policy that allows the principal entity to perform the requested action, then the code returns a final decision of Allow. If there is no resource-based policy, or if the policy does not include an Allow statement, then the code continues. This logic can behave differently if you specify the ARN of an IECS AM role or user as the principal of the resource-based policy. Someone can use session policies to create a temporary credential session for that role or federated user. In that case, the effective permissions for the session might not exceed those allowed by the identity-based policy of the user or role.
3. IAM permissions boundaries - The enforcement code then checks whether the IAM entity that is used by the principal has a permissions boundary. If the policy that is used to set the permissions boundary does not allow the requested action, then the request is implicitly denied. The code returns a final decision of Deny. If there is no permissions boundary, or if the permissions boundary allows the requested action, the evaluation continues.
4. Session policies - The code then checks whether the principal entity is using a session that was assumed by passing a session policy. You can pass a session policy while using temporary credentials for a role or federated user. If the session policy is present and does not allow the requested action, then the request is implicitly denied. The code returns a final decision of Deny. If there is no session policy, or if the policy allows the requested action, the code continues.
5. Identity-based policies - The code then checks the identity-based policies for the principal entity. For an IAM user, these include user policies and policies from groups to which the user belongs. If any statement in any applicable identity-based policies allows the requested action, then the PEM evaluation returns a final decision of Allow. If there are no statements that allow the requested action, then the request is implicitly denied, and the code returns a final decision of DenyErrors that is any errors that are encountered by PEM during the evaluation will throw an exception and stops evaluation.