🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

🏷️ धडा 07 — Conditions आणि ABAC: "फक्त तेव्हाच…"

📍 तुम्ही इथे आहात: 12 पैकी धडा 07 · मागे: lesson-06-machine-identities · पुढे: lesson-08-guardrails

📦 या ब्रँचमध्ये काय आहे

धडे 01–06, आणि त्यासोबत Condition block: IAM बदलांसाठी MFA बंधनकारक (iam-needs-mfa.json), फक्त कार्यालयाचे network (office-network-only.json), आणि ABAC — tags वरून ठरणारा access (abac-own-team.json).

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

काही नियमांच्या शेवटी "फक्त तेव्हाच…" असते:

"तुम्ही ओळखपत्रांच्या नोंदी बदलू शकता — फक्त तेव्हाच जेव्हा तुम्ही तुमचे कार्ड आणि तुमच्या phone वरचा code दाखवला असेल." (MFA)
"प्रगती पुस्तके फक्त शाळेच्या इमारतीच्या आतूनच वाचता येतील." (network)
"तुम्ही lab मधला computer बंद करू शकता फक्त तेव्हाच जेव्हा त्याच्या sticker चा रंग तुमच्या बिल्ल्याच्या रंगाशी जुळतो." (tags)

शेवटचा नियम सगळ्यात हुशार आहे. प्रत्येक team साठी वेगळा नियम नाही, तर एकच नियम असतो — "stickers जुळायला हवेत" — आणि नव्या team ला फक्त sticker चा नवा रंग लागतो.

🗺️ आकृती

flowchart LR
    me["🪪 aishwarya<br/>PrincipalTag team = maths"]
    rule["📝 abac-own-team<br/>StringEquals<br/>ResourceTag/team = PrincipalTag/team"]
    m["🖥️ instance · team = maths"]
    s["🖥️ instance · team = science"]
    me --> rule
    rule -->|"1 tags match"| m --> ok["✅ ALLOW StopInstances"]
    rule -->|"2 tags differ"| s --> no["🚫 IMPLICIT DENY"]

🗺️ काढलेली आकृती + एक lab: https://school-edh.pages.dev/iam/lesson-diagrams.html#l07

❓ काय

आकार — "Condition": { "<operator>": { "<key>": "<value(s)>" } }. सगळे operators आणि keys जुळायलाच हवेत (AND); एका key साठी अनेक values असतील तर त्यांपैकी कोणतीही जुळली तरी चालते (OR).
Operators — StringEquals, StringLike, Bool, NumericLessThan, IpAddress, NotIpAddress, DateGreaterThan, ArnLike, … आणि त्यासोबत …IfExists ("key असेल तरच तपासा") आणि अनेक values असलेल्या keys साठी ForAllValues: / ForAnyValue:.
उपयोगी global keys — aws:MultiFactorAuthPresent, aws:SourceIp, aws:RequestedRegion, aws:PrincipalTag/…, aws:ResourceTag/…, aws:RequestTag/…, aws:TagKeys, aws:PrincipalOrgID, aws:SecureTransport, aws:ViaAWSService.
नसलेल्या keys — request मध्ये नसलेल्या key वरची condition जुळत नाही. दीर्घकाळाच्या access key ने सही केलेल्या request मध्ये aws:MultiFactorAuthPresent नसतेच, म्हणून ती मागणारा Allow लागू होत नाही. Deny नियमांसाठी नेहमीचा pattern म्हणजे "BoolIfExists": {"aws:MultiFactorAuthPresent": "false"}.
ABAC — attribute-based access control: principals आणि resources ना tags लावा, आणि त्यांची तुलना करणारी एकच policy लिहा (${aws:PrincipalTag/team}). Tags चेच संरक्षण करा — लोक स्वतःचे tags बदलू शकले, तर ते स्वतःचा access बदलू शकतात.
aws:SourceIp बाबत सावधानता — VPC endpoint मधून येणाऱ्या requests मध्ये public source IP नसतो (aws:SourceVpc / aws:VpcSourceIp वापरा), आणि AWS services तुमच्या वतीने करणारे calls AWS च्या पत्त्यांवरून येतात — खऱ्या "फक्त कार्यालय" denies मध्ये aws:ViaAWSService चे अपवाद जोडलेले असतात.

🤔 का

तुम्ही कोण आहात एवढे नेहमीच पुरेसे नसते; तुम्ही कसे आणि कुठून विचारता हेही महत्त्वाचे असते. Conditions धोकादायक actions समोर MFA ठेवतात आणि data अपेक्षित networks च्या आतच ठेवतात. ABAC policies चा पसारा थांबवते: दहा teams, एकच policy.

🔧 कसे (या repo मध्ये)

iam/demo.py मधला conditions() एक request context देतो (decide() चा तिसरा argument, condition keys ची dict) — MFA true/false, दोन source IPs, आणि principal/resource tags. iam/evaluate.py मधला _condition_ok() operators, …IfExists, आणि नसलेल्या key चा नियम अमलात आणतो.

🧪 करून पाहा

python3 iam/demo.py conditions
python3 - <<'EOF'
import sys; sys.path.insert(0, "iam"); from evaluate import decide, load
aishwarya = "arn:aws:iam::111122223333:user/aishwarya"
print("MFA key absent      ", decide(aishwarya, "iam:CreateUser", "*", {}, identity=[("iam-needs-mfa", load("iam-needs-mfa"))]))
abac = [("abac-own-team", load("abac-own-team"))]
inst = "arn:aws:ec2:ap-south-1:111122223333:instance/i-0abc"
print("no team tag on me   ", decide(aishwarya, "ec2:StopInstances", inst, {"aws:ResourceTag/team": "maths"}, identity=abac)[0])
print("science = science   ", decide(aishwarya, "ec2:StopInstances", inst, {"aws:PrincipalTag/team": "science", "aws:ResourceTag/team": "science"}, identity=abac)[0])
print("other region        ", decide(aishwarya, "ec2:StopInstances", "arn:aws:ec2:us-east-1:111122223333:instance/i-0abc", {"aws:PrincipalTag/team": "maths", "aws:ResourceTag/team": "maths"}, identity=abac)[0])
EOF

खऱ्या account वर (AWS CLI आणि credentials लागतात) — दोन्ही बाजूंना tags लावा, आणि CLI साठी MFA चा आधार असलेली तात्पुरती credentials मिळवा:

aws iam tag-user --user-name aishwarya --tags Key=team,Value=maths
aws ec2 create-tags --resources i-0abc1234def567890 --tags Key=team,Value=maths
aws sts get-session-token --serial-number arn:aws:iam::111122223333:mfa/aishwarya --token-code 123456

✅ तपासा — तुम्हाला काय दिसायला हवे

conditions MFA साठी आधी 🚫 IMPLICIT DENY आणि मग ✅ ALLOW — identity policy iam-needs-mfa#IamOnlyWithMfa allows it print करतो; कार्यालयातून ✅ ALLOW आणि café मधून ⛔ DENY — explicit Deny in identity policy office-network-only#DenyOutsideOffice; maths-on-maths साठी ✅ ALLOW आणि maths-on-science साठी 🚫 IMPLICIT DENY. तुमचा snippet ('IMPLICIT DENY', 'no policy allows it — AWS denies by default') (request मध्ये MFA key नाही), IMPLICIT DENY (aishwarya वर team tag नाही — variable ला भरायला काहीच नाही), ALLOW (science ला science जुळते: तीच policy, वेगळी team) आणि IMPLICIT DENY (policy चा Resource फक्त ap-south-1 लाच लागू होतो) print करतो.

🏁 तुम्ही आत्ताच काय सिद्ध केले

Conditions मुळे त्याच principal ला MFA, network आणि tags नुसार वेगवेगळी उत्तरे मिळतात — आणि ABAC मुळे एकच policy प्रत्येक team ला चालते.

⚠️ नेहमीच्या चुका

Deny मध्ये "Bool": {"aws:MultiFactorAuthPresent": "false"} — key नसलेल्या requests तो चुकवतो; BoolIfExists वापरा
IP वर आधारित Deny, जो तुमच्या वतीने काम करणाऱ्या AWS services किंवा VPC endpoint traffic बिघडवतो
tags चे संरक्षण न करता ABAC (iam:TagUser, ec2:CreateTags सगळ्यांना)
जिथे StringEquals अपेक्षित होते तिथे StringLike (आणि उलटही)

🏭 प्रत्यक्ष वापरात हे का महत्त्वाचे: "प्रत्येक संवेदनशील गोष्टीसाठी MFA", "data फक्त आमच्या network मधून किंवा आमच्या organization मधून (aws:PrincipalOrgID)" आणि "teams फक्त त्यांनी tag केलेलेच सांभाळतात" या enterprise IAM मधल्या सगळ्यात नेहमीच्या तीन गरजा आहेत — आणि तिन्ही conditions च.

⏭️ पुढे

Admin अधिकार असलेल्या व्यक्तीलाही सगळे करता येऊ नये. Guardrails — permission boundaries आणि SCPs, प्रत्येक policy वरची छते.

git checkout lesson-08-guardrails

🏷️ Lesson 07 — Conditions & ABAC: "only when…"

📍 You are here: Lesson 07 of 12 · Previous: lesson-06-machine-identities · Next: lesson-08-guardrails

📦 What's in this branch

Lessons 01–06, plus the Condition block: MFA required for IAM changes (iam-needs-mfa.json), office network only (office-network-only.json), and ABAC — access decided by tags (abac-own-team.json).

🧒 Explain like I'm 5

Some rules have an "only when…" at the end:

"You may change the ID records — only when you showed your card and a code from your phone." (MFA)
"Report cards may be read only from inside the school building." (network)
"You may switch off a lab computer only when its sticker has the same colour as your badge." (tags)

The last one is the clever one. Instead of a rule per team, there is one rule — "stickers must match" — and a new team only needs a new colour of sticker.

🗺️ Diagram

flowchart LR
    me["🪪 aishwarya<br/>PrincipalTag team = maths"]
    rule["📝 abac-own-team<br/>StringEquals<br/>ResourceTag/team = PrincipalTag/team"]
    m["🖥️ instance · team = maths"]
    s["🖥️ instance · team = science"]
    me --> rule
    rule -->|"1 tags match"| m --> ok["✅ ALLOW StopInstances"]
    rule -->|"2 tags differ"| s --> no["🚫 IMPLICIT DENY"]

🗺️ Drawn version + a lab: https://school-edh.pages.dev/iam/lesson-diagrams.html#l07

❓ What

Shape — "Condition": { "<operator>": { "<key>": "<value(s)>" } }. All operators and keys must match (AND); several values for one key match if any does (OR).
Operators — StringEquals, StringLike, Bool, NumericLessThan, IpAddress, NotIpAddress, DateGreaterThan, ArnLike, … plus …IfExists ("check only if the key is present") and ForAllValues: / ForAnyValue: for multi-valued keys.
Useful global keys — aws:MultiFactorAuthPresent, aws:SourceIp, aws:RequestedRegion, aws:PrincipalTag/…, aws:ResourceTag/…, aws:RequestTag/…, aws:TagKeys, aws:PrincipalOrgID, aws:SecureTransport, aws:ViaAWSService.
Missing keys — a condition on a key that is not in the request does not match. A request signed with a long-term access key carries no aws:MultiFactorAuthPresent, so an Allow that requires it does not apply. For deny rules the usual pattern is "BoolIfExists": {"aws:MultiFactorAuthPresent": "false"}.
ABAC — attribute-based access control: tag principals and resources, write one policy comparing them (${aws:PrincipalTag/team}). Protect the tags themselves — if people can change their own tags, they can change their access.
aws:SourceIp caveats — requests through a VPC endpoint carry no public source IP (use aws:SourceVpc / aws:VpcSourceIp), and calls AWS services make on your behalf come from AWS addresses — real "office only" denies add aws:ViaAWSService exceptions.

🤔 Why

Who you are is not always enough; how and from where you ask matters too. Conditions put MFA in front of dangerous actions and keep data inside expected networks. ABAC stops policy sprawl: ten teams, one policy.

🔧 How (in this repo)

conditions() in iam/demo.py passes a request context (the third argument of decide(), a dict of condition keys) — MFA true/false, two source IPs, and principal/resource tags. _condition_ok() in iam/evaluate.py implements the operators, …IfExists, and the missing-key rule.

🧪 Try it

python3 iam/demo.py conditions
python3 - <<'EOF'
import sys; sys.path.insert(0, "iam"); from evaluate import decide, load
aishwarya = "arn:aws:iam::111122223333:user/aishwarya"
print("MFA key absent      ", decide(aishwarya, "iam:CreateUser", "*", {}, identity=[("iam-needs-mfa", load("iam-needs-mfa"))]))
abac = [("abac-own-team", load("abac-own-team"))]
inst = "arn:aws:ec2:ap-south-1:111122223333:instance/i-0abc"
print("no team tag on me   ", decide(aishwarya, "ec2:StopInstances", inst, {"aws:ResourceTag/team": "maths"}, identity=abac)[0])
print("science = science   ", decide(aishwarya, "ec2:StopInstances", inst, {"aws:PrincipalTag/team": "science", "aws:ResourceTag/team": "science"}, identity=abac)[0])
print("other region        ", decide(aishwarya, "ec2:StopInstances", "arn:aws:ec2:us-east-1:111122223333:instance/i-0abc", {"aws:PrincipalTag/team": "maths", "aws:ResourceTag/team": "maths"}, identity=abac)[0])
EOF

On a real account (needs the AWS CLI and credentials) — tag both sides, and get MFA-backed temporary credentials for the CLI:

aws iam tag-user --user-name aishwarya --tags Key=team,Value=maths
aws ec2 create-tags --resources i-0abc1234def567890 --tags Key=team,Value=maths
aws sts get-session-token --serial-number arn:aws:iam::111122223333:mfa/aishwarya --token-code 123456

✅ Verify — what you should see

conditions prints 🚫 IMPLICIT DENY then ✅ ALLOW — identity policy iam-needs-mfa#IamOnlyWithMfa allows it for MFA; ✅ ALLOW from the office and ⛔ DENY — explicit Deny in identity policy office-network-only#DenyOutsideOffice from the café; ✅ ALLOW for maths-on-maths and 🚫 IMPLICIT DENY for maths-on-science. Your snippet prints ('IMPLICIT DENY', 'no policy allows it — AWS denies by default') (no MFA key in the request), IMPLICIT DENY (no team tag on aishwarya — the variable has nothing to fill in), ALLOW (science matches science: same policy, different team) and IMPLICIT DENY (the policy's Resource only covers ap-south-1).

🏁 What you just proved

Conditions make the same principal get different answers depending on MFA, network and tags — and ABAC lets one policy serve every team.

⚠️ Common mistakes

"Bool": {"aws:MultiFactorAuthPresent": "false"} in a Deny — it misses requests where the key is absent; use BoolIfExists
an IP-based Deny that breaks AWS services acting for you, or VPC endpoint traffic
ABAC without protecting the tags (iam:TagUser, ec2:CreateTags for everyone)
StringLike where StringEquals was meant (and the other way round)

🏭 Why this matters in production: "MFA for anything sensitive", "data only from our network or our organization (aws:PrincipalOrgID)" and "teams manage only what they tag" are three of the most common enterprise IAM requirements — all conditions.

⏭️ Next

Someone with admin rights still should not be able to do everything. Guardrails — permission boundaries and SCPs, the ceilings above every policy.

git checkout lesson-08-guardrails

← Previousmachine identities Next →guardrails

This page is the lesson's README from the lesson-07-conditions-abac branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.