Principals

Question 1

What are AWS Principals and Identities

Answer 1

What are AWS Principals & Identities

• Identities authenticating three ways:
  
  • username and password (user)
  • access key and secret key (service) &
  • access key and secret 3 + temporary session token (role)
• Policies do the authorisation policies dictate what ‘Identities’ have access to.
• Principal is the entity that is allowed or denied access to the ‘Action’, ‘Resource’, & the ‘Condition’ that you have.

Question 2

When working with IAM policies

Answer 2

When working with IAM policies:

1. The “Principal” is implicit because you attach the IAM policies to the USER or ROLE so you don’t need to specify a principal when you’re working with IAM policies as you can’t really, You will use “Principals” with policies that are attached with resources, most common one being a “bucket Policy”
2. the 2nd principal is *.* ⇒ Everyone / “anonymous user” - beware and audit for this e.g s3 * put bucket policy is very powerful

So E.g: of Principal would be:

“Principal”aws:”AWS”:”arn:aws:iam: >> Specific root accounts or accounts/IAM user/federated user/specific role/ service

• You cannot use a wildcard (*) in the Principal element in a role’s trust policy.
• Principal = IAM entity human/application permanent/temp root user/user/ roles-temp tokens
• Users = All applications persistent identities