Security Specialty
AWS IAM Permissions Boundary Explained: What It Is, How It Works and an Example
An IAM permissions boundary (also searched as a "permission boundary") is an advanced feature that uses a managed policy to set the maximum permissions an identity-based policy can grant to a user or role. It never grants permissions by itself: the entity can only perform actions allowed by both its identity-based policies and its boundary.
What is a permissions boundary in AWS?
AWS supports permissions boundaries for IAM entities, which are users and roles. A permissions boundary is an advanced feature that uses a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity. You can use an AWS managed policy or a customer managed policy as the boundary.
The key idea: the entity can perform only the actions that are allowed by both its identity-based policies and its permissions boundary.
How a permissions boundary works
| Identity-based policy | Permissions boundary | Result |
|---|---|---|
| Allows the action | Allows the action | Allowed |
| Allows the action | Does not allow the action | Denied: the boundary caps the permissions |
| Does not allow the action | Allows the action | Denied: a boundary does not grant permissions on its own |
| Explicit Deny in either | Anything | Denied: an explicit deny overrides any allow |
Source: docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html
When you use a policy to set the permissions boundary for a user, it limits the user's permissions but does not provide permissions on its own.
Permissions boundary example
AWS gives this example. The IAM user Shirley should be allowed to manage only Amazon S3, Amazon CloudWatch and Amazon EC2. You set this boundary for the user:
- Boundary: allow `s3:*`, `cloudwatch:*` and `ec2:*`.
- Identity-based policy added later: allow `iam:CreateUser`.
- Result: if Shirley tries to create a user, the operation fails, because the boundary does not allow `iam:CreateUser`.
With only the boundary attached, Shirley has no permissions at all. She needs a separate permissions policy, for example for S3. To let her create users, you must update the boundary to allow it, as well as grant it in a policy.
Delegate permissions safely with boundaries
You can use permissions boundaries to delegate permissions management tasks, such as user creation, to IAM users in your account. People can then act on your behalf within a specific boundary of permissions.
To make sure delegated users always apply the boundary, AWS shows a policy that allows actions such as creating users and attaching policies only when the request includes the required boundary, using the `iam:PermissionsBoundary` condition key with the boundary policy's ARN.
Permissions boundary vs SCP vs session policy
| Policy | Applies to | Key facts |
|---|---|---|
| Permissions boundary | A single IAM user or role in an account | Sets the maximum permissions for that entity. Never grants permissions. |
| Service control policy (SCP) | Member accounts of an AWS Organizations organization | Sets the maximum permissions for the account's IAM users and roles. Never grants permissions, and does not affect the management account. |
| Session policy | A temporary session | AWS lists session policies among the policies that can affect an entity's effective permissions, with an explicit deny in any of them overriding an allow. |
Source: docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html
When a boundary and an SCP are both present, the boundary, the SCP and the identity-based policy must all allow the action. See IAM policy evaluation: SCPs, RCPs and permissions boundaries.
A gotcha: NotPrincipal with Deny
AWS warns not to use resource-based policy statements that include a `NotPrincipal` element with a `Deny` effect for IAM users or roles that have a permissions boundary attached. That combination always denies any IAM principal with a boundary attached, no matter what you list in `NotPrincipal`. AWS recommends using the `ArnNotEquals` condition operator with the `aws:PrincipalArn` context key instead.
Why it matters for the Security Specialty exam
Task 4.2.3 of the SCS-C03 exam is to design, interpret and implement IAM policies that follow least privilege, and the official guide names permission boundaries and session policies as examples. See Domain 4: Identity and Access Management, which is 20% of the exam, and the 4-week study plan.
Frequently asked questions
What is a permissions boundary in AWS?
An advanced IAM feature that uses a managed policy to set the maximum permissions an identity-based policy can grant to a user or role.
Does a permissions boundary grant permissions?
No. It only limits permissions. An entity with a boundary and no permissions policy has no permissions.
Can I attach a permissions boundary to a group?
AWS supports permissions boundaries for IAM entities, which are users and roles.
What is the difference between a permissions boundary and an SCP?
A boundary caps one user or role in an account. An SCP caps the IAM users and roles of member accounts in an organization. Neither grants permissions, and when both exist all of them must allow the action.
Does an explicit deny in a boundary override an allow?
Yes. An explicit deny in any applicable policy overrides an allow.
Sources
- Permissions boundaries for IAM entities (AWS)
- Policy evaluation logic (AWS)
- Service control policies (AWS)
- SCS-C03 Domain 4 (AWS)
AWS updates its programs and documentation. Check the linked official pages for the latest details before you decide or pay.
Practice for your AWS exam
Free practice tests with instant explanations and spaced repetition. No sign-up.
Keep reading
- Security Specialty
AWS Security Specialty Study Plan: A 4-Week Roadmap
A week-by-week SCS-C03 study plan built from the domain weights: what to read, what to practice and how to finish with a timed test.
3 min read - Security Specialty
AWS Security Specialty Exam Tips: 12 Must-Know Facts
12 facts and tactics for SCS-C03 test day: scoring, unscored questions, time per question, question types, retakes and managing the clock.
2 min read - Security Specialty
AWS Services in Scope for SCS-C03: Official List
Every AWS service on the Security Specialty exam, grouped by category, plus what is out of scope and the concepts AWS says to know.
2 min read