🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

🧱 धडा 08 — IAM आणि network सीमा: किमान अधिकार, बंद दारे

📍 तुम्ही इथे आहात: 16 पैकी धडा 08 · मागील: lesson-07-secrets-kms · पुढील: lesson-09-encryption

📦 या ब्रँचमध्ये काय आहे

धडे 01–07, आणि दोन प्रकारच्या सीमा. IAM: grades service ला पाच permissions दिल्या होत्या आणि ती दोनच वापरत होती — least privilege सांगते की उरलेल्या तीन काढून टाका. Network: security group फक्त यादीत असलेल्यांनाच आत येऊ देतो, म्हणून database फक्त app ला स्वीकारतो, बाकी कोणालाही नाही. त्यांच्या भोवती: private subnets, NACLs, समोर एक WAF, आणि internet वरून SSH नाही. sec/demo.py मधले boundaries() दोन्ही दाखवते.

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

प्रत्येक कर्मचाऱ्याला एक चाव्यांचा जुडगा मिळतो. कॅन्टीनमधल्या नव्या मदतनीसने "सुरक्षित राहावे म्हणून सगळ्या चाव्या" मागितल्या. तिला कॅन्टीनची चावी, भांडारखोलीची चावी, मुख्याध्यापकांच्या कार्यालयाची चावी, server-room ची चावी आणि परीक्षेच्या कपाटाची चावी मिळाली. एका महिन्यात तिने दोनच वापरल्या: कॅन्टीन आणि भांडारखोली.

सुरक्षा कार्यालय दारांची नोंदवही पाहते. "तुम्ही दोन चाव्या वापरल्या. उरलेल्या तीन आम्ही परत घेतो." तिचा जुडगा कधी चोरीला गेला, तर चोर पाच नाही, दोनच दारे उघडू शकतो. यालाच least privilege (किमान अधिकार) म्हणतात.

कार्यालय प्रत्येक खोलीवर एक पहारेकरी (security group) सुद्धा ठेवते. परीक्षेच्या कपाटाच्या पहारेकऱ्याकडे एक यादी आहे: "फक्त परीक्षा कार्यालय, आणि फक्त या एकाच दारातून". यादीत नसलेल्या प्रत्येकाला परत पाठवले जाते — कपाट कुठे आहे हे माहीत असले तरी. ज्या विभागात ही कपाटे आहेत त्याला रस्त्याकडे उघडणारे दारच नाही (private subnet).

🗺️ आकृती

flowchart LR
    net["🌍 internet"] --> waf["🧱 WAF<br/>managed rules · rate limit"]
    waf --> alb["⚖️ load balancer<br/>public subnet · sg-alb"]
    subgraph priv["🔒 private subnets"]
      app["🧑‍🏫 grades service<br/>sg-app · port 8080 from sg-alb only"]
      db["🗄️ database<br/>port 5432 from sg-app only"]
    end
    alb --> app
    app --> db
    net -.->|"refused: no SSH, no direct DB"| db
    iam["🪪 IAM role<br/>granted 5 · used 2 → remove 3"] -.-> app

🗺️ काढलेली आकृती + एक lab: https://school-edh.pages.dev/security/lesson-diagrams.html#l08

❓ काय

Least privilege — प्रत्येक व्यक्ती, service आणि role ला फक्त लागतील तेवढ्याच permissions, आणि फक्त लागतील त्याच resources वर. एक bucket पुरेसा असताना ec2:* नाही, Resource: "*" नाही.
दिलेल्या विरुद्ध वापरलेल्या — role काय करू शकतो आणि त्याने काय केले यांच्यातले अंतर हाच काढून टाकायचा भाग. unused_permissions(granted, used) ते काढते. AWS वर IAM Access Analyzer न वापरलेले roles, access keys आणि permissions शोधतो, आणि CloudTrail ने नोंदवलेल्या actions वरून policy generate करू शकतो. IAM मधला Service last accessed data हेच प्रत्येक service साठी दाखवतो.
Security group (SG) — प्रत्येक network interface वरचा stateful, फक्त-allow firewall. यात deny नियम नसतात: यादीत नसलेले सगळे नाकारले जाते. परवानगी असलेल्या traffic ची उत्तरे आपोआप बाहेर जातात. एखादा नियम source म्हणून दुसरा security group देऊ शकतो ("from sg-app"), त्यामुळे app चे IP addresses बदलले तरी नियम app च्या मागे जातो.
Network ACL (NACL) — subnet वरचा stateless filter, ज्यात क्रमांक दिलेले allow आणि deny नियम क्रमाने तपासले जातात. तो stateless असल्यामुळे परतीच्या traffic ला सुद्धा (ephemeral ports) परवानगी द्यावी लागते. Subnet साठी ढोबळ नियमांना NACLs वापरा (उदा. एखादी address range block करणे); बारीक नियमांसाठी security groups वापरा.
Private subnets — internet वरून त्यांच्याकडे कोणताही route नाही. Apps आणि databases इथे राहतात; फक्त load balancer public subnet मध्ये असतो. बाहेर जाणारे traffic NAT gateway किंवा VPC endpoints मधून जाते.
WAF (web application firewall) — load balancer किंवा CloudFront समोरचे नियम: नेहमीच्या हल्ल्यांसाठी managed rule sets (injection आणि XSS patterns, ओळखीचे वाईट inputs), rate limits, geo नियम. हा एक थर आहे, उपाय नाही: धडे 01–03 अजूनही लागू होतात.
Internet वरून SSH नाही — port 22 वर 0.0.0.0/0 नाही. AWS Systems Manager Session Manager वापरा (कोणताही port उघडा नाही, प्रत्येक session ची नोंद).

🤔 का

कारण धडे 01–07 मधले प्रत्येक नियंत्रण एकदा तरी चुकू शकते. एक चूक किती दूर जाते हे सीमा ठरवतात. dynamodb:* असलेला role एका SSRF bug चे रूपांतर delete झालेल्या table मध्ये करतो. 0.0.0.0/0 वरून connections स्वीकारणारा database एका leak झालेल्या password चे रूपांतर संपूर्ण data च्या copy मध्ये करतो. छोट्या permissions आणि बंद दारे प्रत्येक चूक छोटी ठेवतात. Auditor सुद्धा आधी हेच पाहायला मागतो.

🔧 कसे (या repo मध्ये)

sec/cloud.py मध्ये: unused_permissions(granted, used) क्रमवार लावलेला set difference परत करते. reachable(rules, source, port) फक्त-allow security group चे model आहे: एखादा source तेव्हाच आत येतो जेव्हा कोणता तरी नियम तो source (किंवा 0.0.0.0/0) आणि तो port दोन्ही कव्हर करतो. ते security-group चे नाव नेमके जुळवते, आणि IP address ला CIDR range शी जुळवते (10.20.3.4 हा 10.20.0.0/16 च्या आत आहे). sec/demo.py मधले boundaries() चार sources एका अशा SG विरुद्ध तपासते जो sg-alb → 8080 आणि 10.20.0.0/16 → 5432 ला परवानगी देतो.

🧪 करून पाहा

python3 sec/demo.py boundaries
python3 - <<'EOF'
import sys; sys.path.insert(0, "sec"); from cloud import unused_permissions, reachable
granted = ["s3:GetObject", "s3:PutObject", "s3:ListBucket", "kms:Decrypt", "iam:PassRole", "sqs:*"]
used = ["s3:GetObject", "kms:Decrypt"]
print("remove:", unused_permissions(granted, used))
db_sg = [("sg-app", 5432)]
for src, port in (("sg-app", 5432), ("sg-alb", 5432), ("0.0.0.0/0", 5432), ("sg-app", 22)):
    print(f"database SG: {src:<10} → {port:<5} {'allowed' if reachable(db_sg, src, port) else 'refused'}")
open_sg = [("0.0.0.0/0", 22)]
print("a rule for 0.0.0.0/0 on 22 lets in 203.0.113.7 →", reachable(open_sg, "203.0.113.7", 22))
EOF

✅ तपासा — तुम्हाला काय दिसायला हवे

boundaries हे छापते:

── the grades service was granted 5 permissions and used 2 → remove ['dynamodb:*', 'ec2:*', 's3:DeleteObject']
   sg-alb         → port 8080  allowed
   0.0.0.0/0      → port 8080  refused
   10.20.0.0/16   → port 5432  allowed
   198.51.100.9   → port 22    refused
   private subnets for apps and data · WAF in front · no SSH from the internet · least privilege everywhere

तुमचा snippet हे छापतो:

remove: ['iam:PassRole', 's3:ListBucket', 's3:PutObject', 'sqs:*']
database SG: sg-app     → 5432  allowed
database SG: sg-alb     → 5432  refused
database SG: 0.0.0.0/0  → 5432  refused
database SG: sg-app     → 22    refused
a rule for 0.0.0.0/0 on 22 lets in 203.0.113.7 → True

🏁 तुम्ही आत्ताच काय सिद्ध केले

Least-privilege diff ने iam:PassRole काढली — ही permission नव्या resource ला जास्त ताकदीचा role देऊ शकते — आणि एक wildcard, sqs:*. Database चा security group फक्त app ला, फक्त 5432 वर आत येऊ देतो: load balancer सुद्धा नाकारला जातो, आणि app कडून SSH सुद्धा. आणि port 22 वरचा एक निष्काळजी 0.0.0.0/0 नियम internet वरच्या कोणत्याही address ला आत येऊ देतो.

⚠️ नेहमीच्या चुका

"Action": "*", "Resource": "*" "आत्तापुरते" — आणि ते वर्षानुवर्षे तसेच राहते
दीर्घकाळ चालणाऱ्या access keys असलेला एकच IAM user, जो पूर्ण team किंवा CI system मध्ये वाटून वापरला जातो
* वर iam:PassRole, ज्यामुळे role कोणत्याही दुसऱ्या role सह गोष्टी launch करू शकतो
public subnet मधला database किंवा cache, किंवा त्याच्या port वर 0.0.0.0/0
"फक्त debugging साठी" internet ला उघडे ठेवलेले SSH किंवा RDP
WAF injection दुरुस्त करतो असे समजणे — तो नेहमीचे patterns पकडतो, तुमचा bug नाही

🏭 प्रत्यक्ष वापरात

खऱ्या account वर — IAM Access Analyzer ला पूर्ण account मधला न वापरलेला access शोधू द्या, मग findings वाचा:

aws accessanalyzer create-analyzer --analyzer-name school-unused \
    --type ACCOUNT_UNUSED_ACCESS --configuration '{"unusedAccess": {"unusedAccessAge": 90}}'
aws accessanalyzer list-findings-v2 --analyzer-arn <analyzer-arn> \
    --filter '{"findingType": {"eq": ["UnusedPermission"]}}'

Policy attach करण्याआधी तपासा — Access Analyzer चे policy validation wildcards आणि धोकादायक जोड्या flag करते:

aws accessanalyzer validate-policy --policy-type IDENTITY_POLICY --policy-document file://grades-service.json

Grades service साठी least-privilege policy — दोन actions, एक bucket prefix, एक key:

{
  "Version": "2012-10-17",
  "Statement": [
    {"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::school-grades/reports/*"},
    {"Effect": "Allow", "Action": "kms:Decrypt", "Resource": "arn:aws:kms:ap-south-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"}
  ]
}

एकमेकांकडे निर्देश करणारे security groups — database फक्त app चा group स्वीकारतो:

aws ec2 authorize-security-group-ingress --group-id sg-0db0000000000000a \
    --protocol tcp --port 5432 --source-group sg-0app000000000000b
aws ec2 authorize-security-group-ingress --group-id sg-0app000000000000b \
    --protocol tcp --port 8080 --source-group sg-0alb000000000000c

AWS common rule set आणि प्रत्येक IP साठी rate limit असलेले WAF web ACL (Terraform):

resource "aws_wafv2_web_acl" "school" {
  name  = "school-web"
  scope = "REGIONAL"
  default_action {
    allow {}
  }
  rule {
    name     = "aws-common"
    priority = 1
    override_action {
      none {}
    }
    statement {
      managed_rule_group_statement {
        vendor_name = "AWS"
        name        = "AWSManagedRulesCommonRuleSet"
      }
    }
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "aws-common"
      sampled_requests_enabled   = true
    }
  }
  rule {
    name     = "rate-limit"
    priority = 2
    action {
      block {}
    }
    statement {
      rate_based_statement {
        limit              = 1000
        aggregate_key_type = "IP"
      }
    }
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "rate-limit"
      sampled_requests_enabled   = true
    }
  }
  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "school-web"
    sampled_requests_enabled   = true
  }
}

आणि SSH ऐवजी, कोणताही port न उघडता, नोंद ठेवणारा shell:

aws ssm start-session --target i-0123456789abcdef0

🏭 प्रत्यक्ष वापरात हे का महत्त्वाचे: प्रत्येक service ला स्वतःचा role द्या, शून्य permissions पासून सुरुवात करा आणि tests ना लागतील तेवढ्याच जोडा. Access Analyzer findings दर महिन्याला तपासा. Apps आणि data private subnets मध्ये ठेवा, security groups address ranges ऐवजी एकमेकांकडे निर्देशित करा, आणि port 22 सगळीकडे बंद करा.

⏭️ पुढे

दारे बंद आहेत आणि चाव्या थोड्याच आहेत. इमारत खिडकीसाठी एक प्रश्न उरला: data खोल्यांमधून प्रवास करताना, आणि disk वर पडून असताना कुलूपबंद आहे का? पुढे: प्रवासातले आणि साठवलेले encryption.

git checkout lesson-09-encryption

🧱 Lesson 08 — IAM and network boundaries: least privilege, closed doors

📍 You are here: Lesson 08 of 16 · Previous: lesson-07-secrets-kms · Next: lesson-09-encryption

📦 What's in this branch

Lessons 01–07, plus two kinds of boundary. IAM: the grades service was given five permissions and used two — least privilege says remove the other three. Network: a security group lets in only what is listed, so the database accepts the app and nothing else. Around them: private subnets, NACLs, a WAF in front, and no SSH from the internet. boundaries() in sec/demo.py shows both.

🧒 Explain like I'm 5

Every staff member gets a key ring. The new canteen helper asked for "all the keys, to be safe". She got the canteen key, the store-room key, the head's office key, the server-room key and the exam cupboard key. In a month she used two: the canteen and the store room.

The security office looks at the door log. "You used two keys. We take back the other three." If her ring is ever stolen, the thief opens two doors, not five. That is least privilege.

The office also puts a guard at each room (a security group). The exam cupboard's guard has a list: "only the exam office, only through this one door". Anyone not on the list is turned away — even if they know where the cupboard is. The whole wing where the cupboards are has no door to the street at all (a private subnet).

🗺️ Diagram

flowchart LR
    net["🌍 internet"] --> waf["🧱 WAF<br/>managed rules · rate limit"]
    waf --> alb["⚖️ load balancer<br/>public subnet · sg-alb"]
    subgraph priv["🔒 private subnets"]
      app["🧑‍🏫 grades service<br/>sg-app · port 8080 from sg-alb only"]
      db["🗄️ database<br/>port 5432 from sg-app only"]
    end
    alb --> app
    app --> db
    net -.->|"refused: no SSH, no direct DB"| db
    iam["🪪 IAM role<br/>granted 5 · used 2 → remove 3"] -.-> app

🗺️ Drawn version + a lab: https://school-edh.pages.dev/security/lesson-diagrams.html#l08

❓ What

Least privilege — every person, service and role gets only the permissions it needs, on only the resources it needs. Not ec2:*, not Resource: "*" when one bucket will do.
Granted vs used — the gap between what a role may do and what it did do is the part to remove. unused_permissions(granted, used) computes it. On AWS, IAM Access Analyzer finds unused roles, access keys and permissions, and can generate a policy from the actions CloudTrail recorded. Service last accessed data in IAM shows the same per service.
Security group (SG) — a stateful, allow-only firewall on each network interface. No deny rules: anything not listed is refused. Replies to allowed traffic go back out automatically. A rule can name another security group as the source ("from sg-app"), so it follows the app when its IP addresses change.
Network ACL (NACL) — a stateless filter on a subnet, with numbered allow and deny rules checked in order. Because it is stateless, you must also allow the return traffic (ephemeral ports). Use NACLs for broad subnet rules (for example, block one address range); use security groups for the fine rules.
Private subnets — no route from the internet to them. Apps and databases live here; only the load balancer sits in a public subnet. Outbound traffic goes through a NAT gateway or VPC endpoints.
WAF (web application firewall) — rules in front of the load balancer or CloudFront: managed rule sets for common attacks (injection and XSS patterns, known bad inputs), rate limits, geo rules. A layer, not a fix: lessons 01–03 still apply.
No SSH from the internet — no 0.0.0.0/0 on port 22. Use AWS Systems Manager Session Manager (no open port, every session logged).

🤔 Why

Because every control in lessons 01–07 can be missed once. Boundaries decide how far a single mistake travels. A role with dynamodb:* turns an SSRF bug into a deleted table. A database that accepts connections from 0.0.0.0/0 turns one leaked password into a full copy of the data. Small permissions and closed doors make each mistake small. They are also what an auditor asks to see first.

🔧 How (in this repo)

In sec/cloud.py: unused_permissions(granted, used) returns the sorted set difference. reachable(rules, source, port) models an allow-only security group: a source gets in only if some rule covers that source (or is 0.0.0.0/0) and that port. It matches a security-group name exactly, and an IP address against a CIDR range (10.20.3.4 is inside 10.20.0.0/16). boundaries() in sec/demo.py checks four sources against an SG that allows sg-alb → 8080 and 10.20.0.0/16 → 5432.

🧪 Try it

python3 sec/demo.py boundaries
python3 - <<'EOF'
import sys; sys.path.insert(0, "sec"); from cloud import unused_permissions, reachable
granted = ["s3:GetObject", "s3:PutObject", "s3:ListBucket", "kms:Decrypt", "iam:PassRole", "sqs:*"]
used = ["s3:GetObject", "kms:Decrypt"]
print("remove:", unused_permissions(granted, used))
db_sg = [("sg-app", 5432)]
for src, port in (("sg-app", 5432), ("sg-alb", 5432), ("0.0.0.0/0", 5432), ("sg-app", 22)):
    print(f"database SG: {src:<10} → {port:<5} {'allowed' if reachable(db_sg, src, port) else 'refused'}")
open_sg = [("0.0.0.0/0", 22)]
print("a rule for 0.0.0.0/0 on 22 lets in 203.0.113.7 →", reachable(open_sg, "203.0.113.7", 22))
EOF

✅ Verify — what you should see

boundaries prints:

── the grades service was granted 5 permissions and used 2 → remove ['dynamodb:*', 'ec2:*', 's3:DeleteObject']
   sg-alb         → port 8080  allowed
   0.0.0.0/0      → port 8080  refused
   10.20.0.0/16   → port 5432  allowed
   198.51.100.9   → port 22    refused
   private subnets for apps and data · WAF in front · no SSH from the internet · least privilege everywhere

Your snippet prints:

remove: ['iam:PassRole', 's3:ListBucket', 's3:PutObject', 'sqs:*']
database SG: sg-app     → 5432  allowed
database SG: sg-alb     → 5432  refused
database SG: 0.0.0.0/0  → 5432  refused
database SG: sg-app     → 22    refused
a rule for 0.0.0.0/0 on 22 lets in 203.0.113.7 → True

🏁 What you just proved

The least-privilege diff removed iam:PassRole — a permission that can hand a stronger role to a new resource — and a wildcard, sqs:*. The database's security group lets in only the app, only on 5432: even the load balancer is refused, and so is SSH from the app. And one careless 0.0.0.0/0 rule on port 22 lets in any address on the internet.

⚠️ Common mistakes

"Action": "*", "Resource": "*" "for now" — and it stays for years
one IAM user with long-lived access keys shared by a whole team or a CI system
iam:PassRole on *, which lets a role launch things with any other role
a database or cache in a public subnet, or with 0.0.0.0/0 on its port
SSH or RDP open to the internet "only for debugging"
thinking a WAF fixes injection — it catches common patterns, not your bug

🏭 In production

On a real account — let IAM Access Analyzer find unused access across the account, then read the findings:

aws accessanalyzer create-analyzer --analyzer-name school-unused \
    --type ACCOUNT_UNUSED_ACCESS --configuration '{"unusedAccess": {"unusedAccessAge": 90}}'
aws accessanalyzer list-findings-v2 --analyzer-arn <analyzer-arn> \
    --filter '{"findingType": {"eq": ["UnusedPermission"]}}'

Check a policy before you attach it — Access Analyzer's policy validation flags wildcards and risky combinations:

aws accessanalyzer validate-policy --policy-type IDENTITY_POLICY --policy-document file://grades-service.json

A least-privilege policy for the grades service — two actions, one bucket prefix, one key:

{
  "Version": "2012-10-17",
  "Statement": [
    {"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::school-grades/reports/*"},
    {"Effect": "Allow", "Action": "kms:Decrypt", "Resource": "arn:aws:kms:ap-south-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"}
  ]
}

Security groups that point at each other — the database accepts only the app's group:

aws ec2 authorize-security-group-ingress --group-id sg-0db0000000000000a \
    --protocol tcp --port 5432 --source-group sg-0app000000000000b
aws ec2 authorize-security-group-ingress --group-id sg-0app000000000000b \
    --protocol tcp --port 8080 --source-group sg-0alb000000000000c

A WAF web ACL with the AWS common rule set and a rate limit per IP (Terraform):

resource "aws_wafv2_web_acl" "school" {
  name  = "school-web"
  scope = "REGIONAL"
  default_action {
    allow {}
  }
  rule {
    name     = "aws-common"
    priority = 1
    override_action {
      none {}
    }
    statement {
      managed_rule_group_statement {
        vendor_name = "AWS"
        name        = "AWSManagedRulesCommonRuleSet"
      }
    }
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "aws-common"
      sampled_requests_enabled   = true
    }
  }
  rule {
    name     = "rate-limit"
    priority = 2
    action {
      block {}
    }
    statement {
      rate_based_statement {
        limit              = 1000
        aggregate_key_type = "IP"
      }
    }
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "rate-limit"
      sampled_requests_enabled   = true
    }
  }
  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "school-web"
    sampled_requests_enabled   = true
  }
}

And instead of SSH, a logged shell with no open port:

aws ssm start-session --target i-0123456789abcdef0

🏭 Why this matters in production: give each service its own role, start from zero permissions and add what the tests need. Review Access Analyzer findings every month. Keep apps and data in private subnets, point security groups at each other instead of at address ranges, and close port 22 everywhere.

⏭️ Next

The doors are closed and the keys are few. One question left for the building desk: is the data locked while it travels between rooms, and while it sits on disk? Next: encryption in transit and at rest.

git checkout lesson-09-encryption

← Previoussecrets kms Next →encryption

This page is the lesson's README from the lesson-08-iam-network branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.