News, updates, and deep dives on AWS IAM security from the Shieldly team.
A permission boundary caps the maximum permissions an IAM identity can ever have — effective permissions are the intersection of policy and boundary. How they work, a reusable boundary, and the mistakes that quietly break them.
A practical checklist for spotting risky IAM, trust, and S3 bucket policies before they ship — wildcards, PassRole, NotAction traps, public principals — plus free browser tools that flag each one.
NotAction is not a deny — it allows every action you did not list. A single Allow + NotAction statement can grant near-administrator access. How the trap works and how to fix it.
The confused deputy attack lets any tenant of a SaaS assume another tenant's cross-account role if the trust policy is too broad. ExternalId is the condition that closes the gap.
Move IAM security review left into the pull request. The Shieldly GitHub Action comments risky findings and can fail the check on high-severity issues — wired up in five minutes.
After analyzing thousands of IAM policies, the same seven patterns show up again and again — wildcards, unsafe PassRole, public S3, NotAction traps, and more. Each one explained and fixed.
Trust policies control who can assume an IAM role. Confused deputy attacks, overly broad principals, and missing ExternalId conditions are the most common misconfigurations — here is how to find and fix them.
CloudFormation templates are a hidden source of IAM risk. How overly-permissive roles, missing permission boundaries, and wildcards sneak in — and how to catch them before cdk deploy or stack create.
S3 bucket policies are a frequent source of data exposure. The most common misconfigurations — overly broad principals, missing conditions, and public-access mistakes — and how to fix them.
iam:PassRole is one of the most dangerous and misunderstood IAM permissions — not because of what it does on its own, but because of what it enables when combined with compute services. How to scope it safely.
Privilege escalation rarely comes from a single admin policy — it hides in benign-looking combinations of permissions. A breakdown of the most common AWS IAM escalation paths and how to detect them before attackers do.
Least privilege is the most repeated advice in AWS security and the least often followed. A practical workflow for scoping down IAM policies — actions, resources, conditions — without grinding your team to a halt.
Action: *, Resource: *, and Principal: * are the three most dangerous wildcards in AWS IAM. What each one really grants, and how to scope it down safely.
We're launching Shieldly — an AI-powered tool that analyzes AWS IAM policies, CloudFormation templates, and resource policies to catch overly-permissive access, privilege escalation paths, and misconfigurations that static tools miss.