Hey folks,
In the weeks leading up to AWS re:Invent, the content teams often sprinkle a few notable tidbits here and there, saving the big stuff for the main event. Sometimes it’s a teaser for an upcoming product release, other times it’s getting in front of something that they know will be in focus. Either way, it’s fun (but futile) to speculate what they’ll announce.
For IAM, one element of note is an update to the commonly referenced Policy Evaluation Logic diagram – seemingly in an attempt to clarify some of the nuances, specifically around Session Policies and Resource Policies. Like any trusted piece of software, IAM is deterministic in the sense that it will always behave exactly as it should. It’s complicated because of all the inputs and surrounding context that could impact the decision making process.
Knowing the decision flow is critical to understanding how IAM works, but it hardly paints the whole picture. With such a multi-dimensional domain, though, can you even paint the whole picture? This is the fundamental challenge that makes IAM hard to learn. Our mental models simply aren’t aligned to the space, no matter how much studying one does.
A way to approach something so multi-dimensional is to continually adjust your perspective. The Policy Evaluation Logic as presented is the perspective of a single request. But if you want to know why a user has permissions to do one thing but not another, or why a resource can be accessed from one role but not another, you have to change your perspective. A sentence I like to use to orient myself is, “this principal has permissions for these actions on these resources because of these policies.” This perspective has its own set of inputs and context that impact the answer, of course, but it can be reasoned with just like that of a single request.
As you embark on an IAM learning path, I find it helpful to constantly adjust your perspective. You start to pick up the nuances along the way. There’s plenty of tools to test and validate every deterministic element, but you’ll always be the only one responsible for your own mental model, so the more you truly comprehend, the better.
Cheers,
Ivan
Tweet
Share