AWS IAM advanced — SCPs, permission boundaries and Access Analyzer

AWS Identity and Access Management controls who can do what in an AWS account, but standard IAM policies alone cannot protect against a compromised privileged user, a misconfigured role with excessive permissions, or an attacker who has achieved account-level access. Three advanced IAM controls address these scenarios: Service Control Policies that set hard upper bounds on permissions across entire AWS Organizations accounts, permission boundaries that safely delegate role creation without granting privilege escalation, and IAM Access Analyzer that continuously identifies unintended external access to resources.

These controls operate at different layers of the permission evaluation model. SCPs filter every API call regardless of what identity policies exist. Permission boundaries constrain what any role created by a delegated identity can do. Access Analyzer inspects resource policies to find cross-account and public access that was not explicitly intended. Together they form a defence-in-depth IAM architecture where each control catches a class of misconfiguration that the others cannot address.