aws-iam

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

AWS IAM — Common Pitfalls

AWS IAM — 常见误区

About This Skill

关于此Skill

This skill contains verified corrections for things that AI agents frequently get wrong about IAM. It is not a comprehensive IAM guide — for full IAM guidance, search AWS documentation.

When answering IAM questions, verify specific claims (limits, quotas, exact API names, edge-case behaviors) against official AWS documentation rather than relying on pre-training. Prefer fetching known documentation URLs over broad searches. Trust official documentation over memory when they conflict.

本Skill包含针对AI Agent在IAM相关问题上常犯错误的验证修正内容。它并非全面的IAM指南——如需完整的IAM指导，请查阅AWS官方文档。

在回答IAM相关问题时，请对照AWS官方文档验证具体声明（如限制、配额、准确API名称、边缘场景行为），而非依赖预训练内容。优先获取已知的官方文档URL，而非进行宽泛搜索。当记忆内容与官方文档冲突时，以官方文档为准。

Verified Edge Cases

已验证的边缘场景

CloudTrail:

AcceptHandshake/DeclineHandshake logged in ACTING account ONLY, not management account. Organization trail required for centralization.
ConsoleLogin region varies by endpoint/cookies, NOT always us-east-1.
```
?region=
```
forces specific region.

STS:

GetSessionToken restrictions: (1) No IAM APIs unless MFA included (2) No STS except AssumeRole and GetCallerIdentity.
Cross-account AssumeRole to opt-in region: TARGET account must enable region, not calling account.
Role chaining: max 1-hour session.

Organizations:

Suspended/closed accounts CANNOT be removed until permanently closed (~90 days). Remove FIRST, then close.
Policy management delegation: use PutResourcePolicy, NOT register-delegated-administrator.
AI opt-out policies: management account required by default.
Organizations policy types for ListPolicies filter: SERVICE_CONTROL_POLICY, TAG_POLICY, BACKUP_POLICY, AISERVICES_OPT_OUT_POLICY, CHATBOT_POLICY, DECLARATIVE_POLICY_EC2, RESOURCE_CONTROL_POLICY.

SDK Specifics:

Organizations:
```
DuplicatePolicyAttachmentException
```
(not PolicyAlreadyAttachedException).
Boto3 IAM AccessKey: methods are
```
activate()
```
,
```
deactivate()
```
,
```
delete()
```
— NO
```
update()
```
.
Instance profiles: waiter +
```
time.sleep(10)
```
pattern.
Managed policy max versions: 5.

SAML:

Encrypted assertions URL:

https://region-code.signin.aws.amazon.com/saml/acs/IdP-ID

Private key from IdP uploaded to IAM in .pem format.

Policy Evaluation:

ForAllValues with empty/missing key: evaluates to true (vacuous truth). To avoid that, use a
```
Null
```
condition in addition to the
```
ForAllValues
```
on the same context key to require that key to be present and non-null. For example, when evaluating the
```
aws:TagKeys
```
context key:

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Action": "ec2:RunInstances",
        "Resource": "*",
        "Condition": {
            "ForAllValues:StringEquals": {
                "aws:TagKeys": ["Alpha", "Beta"]
            },
            "Null": {
                "aws:TagKeys": "false"
            }
        }
    }
}

Resource-based policies granting to IAM user ARN bypass permissions boundaries in same account.
8 privilege escalation actions via direct IAM policy manipulation: PutGroupPolicy, PutRolePolicy, PutUserPolicy, CreatePolicy, CreatePolicyVersion, AttachGroupPolicy, AttachRolePolicy, AttachUserPolicy.
```
iam:PassRole
```
with
```
Resource: "*"
```
+ create/update on a compute service (EC2
```
RunInstances
```
, Lambda
```
CreateFunction
```
/
```
UpdateFunctionConfiguration
```
, ECS
```
RegisterTaskDefinition
```
, Glue, SageMaker, CloudFormation, etc.) = privilege escalation to any passable role in the account, including Administrator. Scope
```
Resource
```
to specific role ARNs or an IAM path; optionally constrain with
```
iam:PassedToService
```
/
```
iam:AssociatedResourceArn
```
. See IAM User Guide — Grant a user permissions to pass a role.

MFA:

Unassigned virtual MFA devices auto-deleted when adding new ones.
MFA resync-only policy NotAction needs exactly: iam:ListMFADevices, iam:ListVirtualMFADevices, iam:ResyncMFADevice.

SigV4:

IncompleteSignatureException includes SHA-256 hash of Authorization header for transit modification diagnosis.

Service-Specific Roles:

Redshift Serverless trust policy: include BOTH
```
redshift-serverless.amazonaws.com
```
AND
```
redshift.amazonaws.com
```
as service principals (per AWS docs; omitting serverless causes
```
Not authorized to get credentials of role
```
on COPY).
IAM OIDC providers: thumbprints no longer required for most providers (AWS verifies via trusted CAs since 2022).

Policy Summary Display:

Single statement with multi-service wildcard actions (e.g.
```
codebuild:*
```
,
```
codecommit:*
```
) + service-specific resource ARNs: each resource appears ONLY under its matching service's summary (CodeBuild ARN under CodeBuild, etc.). A resource whose service prefix matches NO action in the statement is the only case where it appears in all action summaries ("mismatched resource").

CloudTrail相关：

AcceptHandshake/DeclineHandshake操作仅在执行操作的账户中记录，而非管理账户。如需集中记录，需使用组织级追踪（Organization trail）。
ConsoleLogin的区域由端点/ Cookie决定，并非始终是us-east-1。通过
```
?region=
```
参数可强制指定特定区域。

STS相关：

GetSessionToken的限制：(1) 除非包含MFA，否则无法调用IAM API；(2) 除AssumeRole和GetCallerIdentity外，无法调用其他STS API。
跨账户AssumeRole至可选区域：目标账户必须启用该区域，而非调用方账户。
角色链：最长会话时长为1小时。

Organizations相关：

已暂停/已关闭的账户需等待永久关闭（约90天）后才能移除。请先移除账户，再执行关闭操作。
策略管理委托：使用PutResourcePolicy，而非register-delegated-administrator。
AI退出策略：默认需由管理账户操作。
ListPolicies筛选器对应的Organizations策略类型包括：SERVICE_CONTROL_POLICY、TAG_POLICY、BACKUP_POLICY、AISERVICES_OPT_OUT_POLICY、CHATBOT_POLICY、DECLARATIVE_POLICY_EC2、RESOURCE_CONTROL_POLICY。

SDK细节：

Organizations：抛出
```
DuplicatePolicyAttachmentException
```
（而非PolicyAlreadyAttachedException）。
Boto3 IAM AccessKey的方法为
```
activate()
```
、
```
deactivate()
```
、
```
delete()
```
——不存在
```
update()
```
方法。
实例配置文件：需结合waiter与
```
time.sleep(10)
```
的模式使用。
托管策略的最大版本数：5。

SAML相关：

加密断言URL：

https://region-code.signin.aws.amazon.com/saml/acs/IdP-ID

。

从身份提供商（IdP）获取的私钥需以.pem格式上传至IAM。

策略评估：

当ForAllValues搭配空值/缺失的键时，评估结果为true（空真）。如需避免这种情况，需在同一上下文键上同时使用
```
Null
```
条件与
```
ForAllValues
```
，以要求该键必须存在且非空。例如，在评估
```
aws:TagKeys
```
上下文键时：

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Action": "ec2:RunInstances",
        "Resource": "*",
        "Condition": {
            "ForAllValues:StringEquals": {
                "aws:TagKeys": ["Alpha", "Beta"]
            },
            "Null": {
                "aws:TagKeys": "false"
            }
        }
    }
}

授予IAM用户ARN的基于资源的策略会绕过同一账户内的权限边界。
通过直接操作IAM策略可实现8种权限提升操作：PutGroupPolicy、PutRolePolicy、PutUserPolicy、CreatePolicy、CreatePolicyVersion、AttachGroupPolicy、AttachRolePolicy、AttachUserPolicy。
当
```
iam:PassRole
```
的
```
Resource
```
设为
```
"*"
```
，同时拥有计算服务的创建/更新权限（如EC2
```
RunInstances
```
、Lambda
```
CreateFunction
```
/
```
UpdateFunctionConfiguration
```
、ECS
```
RegisterTaskDefinition
```
、Glue、SageMaker、CloudFormation等）时，可实现对账户内所有可传递角色（包括管理员角色）的权限提升。请将
```
Resource
```
限定为特定角色ARN或IAM路径；可选择通过
```
iam:PassedToService
```
/
```
iam:AssociatedResourceArn
```
进行约束。详情请参阅IAM用户指南——授予用户传递角色的权限。

MFA相关：

未分配的虚拟MFA设备会在添加新设备时自动删除。
仅允许MFA重新同步的策略中，NotAction需精确包含：iam:ListMFADevices、iam:ListVirtualMFADevices、iam:ResyncMFADevice。

SigV4相关：

IncompleteSignatureException会包含Authorization头的SHA-256哈希值，用于诊断传输过程中的修改问题。

服务特定角色：

Redshift Serverless信任策略：需同时包含
```
redshift-serverless.amazonaws.com
```
与
```
redshift.amazonaws.com
```
作为服务主体（依据AWS文档；省略serverless会导致COPY操作时出现
```
Not authorized to get credentials of role
```
错误）。
IAM OIDC提供商：大多数提供商不再需要指纹（自2022年起，AWS通过受信任CA进行验证）。

策略摘要显示：

单条语句包含多服务通配符操作（如
```
codebuild:*
```
、
```
codecommit:*
```
）+ 服务特定资源ARN时，每个资源仅会出现在匹配服务的摘要下（CodeBuild ARN出现在CodeBuild摘要下等）。只有当资源的服务前缀与语句中的任何操作都不匹配时，才会出现在所有操作摘要中（“不匹配资源”）。