Kill the Castle: How AWS IAM Replaces Network Perimeters

# Terraform: GitHub Actions OIDC provider
resource "aws_iam_openid_connect_provider" "github" {
  url             = "https://token.actions.githubusercontent.com"
  client_id_list  = ["sts.amazonaws.com"]
  thumbprint_list = ["6938fd4d98bab03faadb97b34396831e3780aea1"]
}

resource "aws_iam_role" "github_deploy" {
  name = "github-actions-deploy"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = {
        Federated = aws_iam_openid_connect_provider.github.arn
      }
      Action = "sts:AssumeRoleWithWebIdentity"
      Condition = {
        StringEquals = {
          "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
        }
        StringLike = {
          # Pin to specific repo AND branch - not org-wide
          "token.actions.githubusercontent.com:sub" = "repo:your-org/your-repo:ref:refs/heads/main"
        }
      }
    }]
  })
}

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "ABACTeamAndClassificationMatch",
    "Effect": "Allow",
    "Action": ["s3:GetObject", "s3:PutObject"],
    "Resource": "arn:aws:s3:::acme-datalake-*/*",
    "Condition": {
      "StringEquals": {
        "aws:PrincipalTag/team": "${s3:ResourceTag/team}",
        "aws:PrincipalTag/data-classification": "${s3:ResourceTag/data-classification}",
        "aws:PrincipalTag/cost-center": "${s3:ResourceTag/cost-center}"
      },
      "StringEqualsIfExists": {
        "aws:PrincipalTag/compliance-scope": "${s3:ResourceTag/compliance-scope}"
      },
      "Bool": {
        "aws:MultiFactorAuthPresent": "true"
      }
    }
  }]
}

sts = boto3.client('sts')
response = sts.assume_role(
    RoleArn='arn:aws:iam::123456789012:role/ml-training-pipeline',
    RoleSessionName='feature-extraction-daily-2026-09-22',
    Policy=json.dumps({
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::acme-datalake-txn-raw/2026/09/22/*",
            "Condition": {
                "StringEquals": {
                    "s3:ResourceTag/data-classification": "restricted",
                    "s3:ResourceTag/compliance-scope": "pci-dss"
                }
            }
        }]
    }),
    Tags=[
        {"Key": "triggered-by", "Value": "airflow-dag-feature-extract"},
        {"Key": "run-id", "Value": "run-2026-09-22-0400"},
    ],
    DurationSeconds=900  # 15 minutes - just enough for the ETL window
)

# Security group: ZERO inbound rules
resource "aws_security_group" "workload" {
  name_prefix = "zero-trust-workload-"
  vpc_id      = var.vpc_id

  # No ingress rules at all

  egress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]  # HTTPS to AWS APIs only
    description = "SSM, CloudWatch, S3 (gateway endpoint preferred)"
  }
}

# SSM access is authenticated via IAM, logged to CloudTrail
resource "aws_iam_role_policy_attachment" "ssm" {
  role       = aws_iam_role.workload.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

# Forward local port 5432 to RDS through SSM - no inbound SG rules needed
aws ssm start-session \
  --target i-0abc123def456 \
  --document-name AWS-StartPortForwardingSessionToRemoteHost \
  --parameters '{"host":["mydb.cluster-xyz.us-east-1.rds.amazonaws.com"],"portNumber":["5432"],"localPortNumber":["5432"]}'

┌─────────────────────────────────────────────────────────┐
│                    VPC Lattice                          │
│                                                         │
│  ┌──────────┐    SigV4 Auth    ┌──────────┐            │
│  │ Service A ├────────────────►│ Service B │            │
│  │ (VPC-1)  │  IAM Policy      │ (VPC-2)  │            │
│  └──────────┘  Per-Request     └──────────┘            │
│                                                         │
│  Auth Policy:                                           │
│  ─ Principal matches role/service-a-prod                │
│  ─ HTTP method is GET or POST                           │
│  ─ Path matches /api/v2/*                               │
│  ─ Header X-Request-Source equals "internal"            │
└─────────────────────────────────────────────────────────┘

resource "aws_vpc_endpoint" "s3_interface" {
  vpc_id             = var.vpc_id
  service_name       = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type  = "Interface"
  subnet_ids         = var.private_subnet_ids

  # Endpoint policy: only this account's buckets, only from this VPC
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = "*"
      Action    = ["s3:GetObject", "s3:PutObject"]
      Resource  = "arn:aws:s3:::acme-datalake-*/*"
      Condition = {
        StringEquals = {
          "aws:PrincipalOrgID" = var.org_id
        }
      }
    }]
  })
}

# Egress-only security group - whitelist, not blacklist
resource "aws_security_group" "strict_egress" {
  name_prefix = "strict-egress-"
  vpc_id      = var.vpc_id

  # AWS APIs via VPC endpoints only
  egress {
    from_port       = 443
    to_port         = 443
    protocol        = "tcp"
    security_groups = [aws_security_group.vpc_endpoints.id]
    description     = "AWS APIs via PrivateLink"
  }

  # Internal service mesh
  egress {
    from_port       = 8443
    to_port         = 8443
    protocol        = "tcp"
    security_groups = [aws_security_group.mesh_services.id]
    description     = "mTLS mesh traffic"
  }

  # DNS
  egress {
    from_port   = 53
    to_port     = 53
    protocol    = "udp"
    cidr_blocks = [var.vpc_cidr]
    description = "VPC DNS resolver"
  }

  # Everything else: DENIED by default
}

┌──────────────┐                          ┌──────────────┐
│   Service A  │                          │   Service B  │
│              │     mTLS Handshake       │              │
│  ┌────────┐  │◄────────────────────────►│  ┌────────┐  │
│  │Envoy   │  │  1. Present client cert  │  │Envoy   │  │
│  │Sidecar │  │  2. Verify server cert   │  │Sidecar │  │
│  │        │  │  3. Check SPIFFE ID      │  │        │  │
│  └────────┘  │  4. Encrypted channel    │  └────────┘  │
└──────────────┘                          └──────────────┘
         │                                         │
         └──────── Certificates from ──────────────┘
                   SPIRE / Istio CA / 
                   ACM Private CA

# Kubernetes ServiceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
  name: payment-processor
  namespace: payments

---
# EKS Pod Identity Association (via Terraform)
# This binds the K8s SA to a specific IAM role

resource "aws_eks_pod_identity_association" "payment_processor" {
  cluster_name    = aws_eks_cluster.main.name
  namespace       = "payments"
  service_account = "payment-processor"
  role_arn        = aws_iam_role.payment_processor.arn
}

resource "aws_iam_role" "payment_processor" {
  name = "eks-payment-processor"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = {
        Service = "pods.eks.amazonaws.com"
      }
      Action = ["sts:AssumeRole", "sts:TagSession"]
    }]
  })
}

# This role can ONLY access the payments DynamoDB table
resource "aws_iam_role_policy" "payment_processor" {
  role = aws_iam_role.payment_processor.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:Query"]
      Resource = "arn:aws:dynamodb:*:*:table/payments-*"
    }]
  })
}

SPIFFE ID: spiffe://production.example.com/ns/payments/sa/payment-processor

┌────────────────┐        ┌──────────┐        ┌────────────────┐
│  EKS Workload  │        │  SPIRE   │        │  GCP Workload  │
│                │◄──────►│  Server  │◄──────►│                │
│  SVID Cert:    │        │          │        │  SVID Cert:    │
│  5min TTL      │        │  Central │        │  5min TTL      │
│                │        │  Attestor│        │                │
└────────────────┘        └──────────┘        └────────────────┘

# Kyverno ClusterPolicy: Enforce image signatures
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signatures
spec:
  validationFailureAction: Enforce
  background: false
  rules:
    - name: verify-cosign-signature
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - "123456789012.dkr.ecr.*.amazonaws.com/*"
          attestors:
            - entries:
                - keys:
                    publicKeys: |-
                      -----BEGIN PUBLIC KEY-----
                      MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE...
                      -----END PUBLIC KEY-----
          attestations:
            - type: https://cosign.sigstore.dev/attestation/vuln/v1
              conditions:
                - all:
                    - key: "{{ scanner.result.criticalCount }}"
                      operator: LessThanOrEquals
                      value: "0"

Request ──► [Gate 1: Network]    ──► [Gate 2: IAM Policy]    ──► [Gate 3: Resource Policy] ──► [Gate 4: KMS Key Policy] ──► Data
             VPC Endpoint             sts:AssumeRole              S3 Bucket Policy                CMK Decrypt
             aws:sourceVpce           Principal perms             Explicit Allow                  Explicit Allow

# Gate 1: S3 bucket policy - requires specific VPC endpoint AND org
resource "aws_s3_bucket_policy" "sensitive_data" {
  bucket = aws_s3_bucket.sensitive.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "DenyNonVPCE"
        Effect    = "Deny"
        Principal = "*"
        Action    = "s3:*"
        Resource = [
          aws_s3_bucket.sensitive.arn,
          "${aws_s3_bucket.sensitive.arn}/*"
        ]
        Condition = {
          StringNotEquals = {
            "aws:sourceVpce" = aws_vpc_endpoint.s3.id
          }
        }
      },
      {
        Sid       = "DenyOutsideOrg"
        Effect    = "Deny"
        Principal = "*"
        Action    = "s3:*"
        Resource = [
          aws_s3_bucket.sensitive.arn,
          "${aws_s3_bucket.sensitive.arn}/*"
        ]
        Condition = {
          StringNotEquals = {
            "aws:PrincipalOrgID" = var.org_id
          }
        }
      },
      {
        Sid       = "AllowAuthorizedRoles"
        Effect    = "Allow"
        Principal = {
          AWS = var.authorized_role_arns
        }
        Action = ["s3:GetObject"]
        Resource = "${aws_s3_bucket.sensitive.arn}/*"
      }
    ]
  })
}

# Gate 2: KMS key policy - independent authorization
resource "aws_kms_key" "data_key" {
  description             = "CMK for sensitive data encryption"
  deletion_window_in_days = 30
  enable_key_rotation     = true

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "KeyAdministration"
        Effect    = "Allow"
        Principal = { AWS = "arn:aws:iam::${var.account_id}:role/SecurityAdmin" }
        Action    = ["kms:Create*", "kms:Describe*", "kms:Enable*", "kms:List*",
                     "kms:Put*", "kms:Update*", "kms:Revoke*", "kms:Disable*",
                     "kms:Get*", "kms:Delete*", "kms:ScheduleKeyDeletion"]
        Resource  = "*"
      },
      {
        Sid       = "KeyUsage"
        Effect    = "Allow"
        Principal = { AWS = var.authorized_role_arns }
        Action    = ["kms:Decrypt", "kms:GenerateDataKey"]
        Resource  = "*"
        Condition = {
          StringEquals = {
            "kms:ViaService"     = "s3.${var.region}.amazonaws.com"
            "aws:PrincipalOrgID" = var.org_id
          }
        }
      }
    ]
  })
}

# Gate 3: Enforce SSE-KMS on all objects
resource "aws_s3_bucket_server_side_encryption_configuration" "sensitive" {
  bucket = aws_s3_bucket.sensitive.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.data_key.arn
    }
    bucket_key_enabled = true
  }
}

GuardDuty Finding ──► EventBridge Rule ──► Lambda ──► Revoke STS Sessions
(Anomalous API call)   (Pattern match)    (Automated)  (Immediate)

# Lambda: Revoke all active sessions for a compromised IAM role
import boto3
import json
from datetime import datetime, timezone

iam = boto3.client('iam')

def handler(event, context):
    detail = event['detail']
    finding_type = detail['type']

    # GuardDuty findings indicating credential compromise
    compromise_indicators = [
        'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration',
        'UnauthorizedAccess:IAMUser/TorIPCaller',
        'Discovery:S3/MaliciousIPCaller',
        'UnauthorizedAccess:IAMUser/MaliciousIPCaller.Custom',
    ]

    if finding_type not in compromise_indicators:
        return

    # Extract the compromised principal
    resource = detail['resource']
    access_key_id = resource.get('accessKeyDetails', {}).get('accessKeyId')
    principal_id = resource.get('accessKeyDetails', {}).get('principalId')
    user_name = resource.get('accessKeyDetails', {}).get('userName')

    # Revoke all sessions by applying an inline deny-all policy
    # with a time condition that invalidates tokens issued before now
    revocation_policy = {
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "DateLessThan": {
                    "aws:TokenIssueTime": datetime.now(timezone.utc).isoformat()
                }
            }
        }]
    }

    # Apply to the role (for assumed-role principals)
    role_name = extract_role_name(principal_id)
    if role_name:
        iam.put_role_policy(
            RoleName=role_name,
            PolicyName='EmergencySessionRevocation',
            PolicyDocument=json.dumps(revocation_policy)
        )
        print(f"Revoked all sessions for role: {role_name}")

    # Notify security team
    sns = boto3.client('sns')
    sns.publish(
        TopicArn='arn:aws:sns:us-east-1:123456789012:security-alerts',
        Subject=f'CREDENTIAL COMPROMISE: {role_name or user_name}',
        Message=json.dumps(detail, indent=2, default=str)
    )

def extract_role_name(principal_id):
    """Extract role name from principal ID (AROA...)"""
    if not principal_id:
        return None
    # For assumed roles, principal_id format: AROAEXAMPLE:session-name
    # Look up the role via the access key or other detail
    # Implementation depends on your naming conventions
    pass

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PreventCloudTrailDisable",
      "Effect": "Deny",
      "Action": [
        "cloudtrail:StopLogging",
        "cloudtrail:DeleteTrail",
        "cloudtrail:UpdateTrail"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotLike": {
          "aws:PrincipalArn": "arn:aws:iam::*:role/OrganizationSecurityAudit"
        }
      }
    },
    {
      "Sid": "PreventKMSKeyDeletion",
      "Effect": "Deny",
      "Action": [
        "kms:ScheduleKeyDeletion",
        "kms:DisableKey"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotLike": {
          "aws:PrincipalArn": "arn:aws:iam::*:role/KMSAdministrator"
        }
      }
    },
    {
      "Sid": "EnforceIMDSv2",
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "StringNotEquals": {
          "ec2:MetadataHttpTokens": "required"
        }
      }
    },
    {
      "Sid": "DenyPublicS3",
      "Effect": "Deny",
      "Action": [
        "s3:PutBucketPublicAccessBlock",
        "s3:PutAccountPublicAccessBlock"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "s3:PublicAccessBlockConfiguration/BlockPublicAcls": "true"
        }
      }
    }
  ]
}

resource "aws_accessanalyzer_analyzer" "org_level" {
  analyzer_name = "organization-analyzer"
  type          = "ORGANIZATION"

  # Generates findings for any resource accessible outside the org
}

resource "aws_accessanalyzer_analyzer" "unused_access" {
  analyzer_name = "unused-access-analyzer"
  type          = "ACCOUNT_UNUSED_ACCESS"

  configuration {
    unused_access {
      unused_access_age = 90
    }
  }
}

# What the architecture diagram shows:
Pod A → Role A (scoped to DynamoDB)
Pod B → Role B (scoped to S3)
Pod C → Role C (scoped to SQS)

# What actually runs in production:
Pod A → shared-role (DynamoDB + S3 + SQS + KMS + SNS + ...)
Pod B → shared-role
Pod C → shared-role