One ETL role handles buckets for several projects.
Allow access only when the role and resource Project tags match.
Which authorization approach is most appropriate?
Compare aws:PrincipalTag and aws:ResourceTag in IAM policy Conditions and control who may change tags.
Detailed explanation
Attribute-based access can limit the role to matching project resources.
Attribute-based access can limit the role to matching project resources.
Recording a tag does not allow or deny an operation.
Recording a tag does not allow or deny an operation.
Role and policy counts grow with each project.
Role and policy counts grow with each project.
A UI check is not an enforced authorization condition.
A UI check is not an enforced authorization condition.
Check official documentation
Compare the following points with the official documentation.
AWS IAM ABAC、PrincipalTag、ResourceTag condition keysの公式説明を確認する。
What to confirm
名称規則と属性ベースアクセス制御の違いを説明できる。
Key points
- ABAC
- PrincipalTag
- ResourceTag
- Condition
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Tag trust
Separate tag-changing authority so a caller cannot grant itself access by editing tags.
Audit
Correlate tag changes with access events and investigate unexpected authorization.