Permission Boundary
Identity & AccessA Permission Boundary is a managed IAM policy that you attach to an IAM user or role to define the maximum permissions that entity can have. It does not grant permissions - it limits what identity-based policies can effectively allow.
Think of it as a filter: the effective permissions are the intersection of the identity-based policy and the permission boundary. If a policy allows s3:* but the boundary only allows s3:GetObject, the effective permission is only s3:GetObject.
Use Cases
- Delegation: allow developers to create IAM roles for their applications, but only within the boundary you define
- Privilege escalation prevention: prevent users from creating roles with more permissions than they have
- Multi-tenant environments: limit each tenant's permissions to their own resources
Related AWS Services
Related Terms
A JSON document that defines permissions - which actions are allowed or denied on which AWS resources, and under what conditions.
An organization-wide guardrail that restricts what actions member accounts can perform, regardless of their IAM policies.
The security principle of granting only the minimum permissions needed to perform a task - no more, no less.
An attack technique where a user gains higher permissions than originally granted, often by exploiting IAM misconfigurations like the ability to create policies or pass roles.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.