Attribute-Based Access Control (ABAC)
Identity & AccessAttribute-Based Access Control (ABAC) is an authorization strategy that defines permissions based on attributes (tags) rather than explicit resource ARNs. In AWS, ABAC uses tags on IAM principals (users, roles) and resources to control access.
How It Works
Instead of writing a policy like "Role X can access S3 bucket Y", you write "Any principal tagged Project=Alpha can access any resource tagged Project=Alpha". The permissions scale automatically as new resources are created with matching tags.
IAM Condition Keys for ABAC
aws:PrincipalTag/key- tag on the IAM principal making the requestaws:ResourceTag/key- tag on the target resourceaws:RequestTag/key- tag being applied in a tagging API callaws:TagKeys- list of tag keys in the request
Benefits over RBAC
- Fewer Policies: one policy works for any number of projects/teams
- Self-Scaling: new resources inherit access through tags, no policy updates needed
- Dynamic: change access by changing tags, not policies
Related AWS Services
Related Content
Related Terms
A JSON document that defines permissions - which actions are allowed or denied on which AWS resources, and under what conditions.
Metadata labels (key-value pairs) applied to AWS resources for organization, cost allocation, access control (ABAC), and compliance tracking.
The security principle of granting only the minimum permissions needed to perform a task - no more, no less.
An AWS identity with temporary credentials that can be assumed by users, services, or applications to perform actions without long-term access keys.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.