AWS IAM Groups: Designing for Least Privilege - Deny Or Allow

Question

I am trying to create the appropriate AWS IAM Groups to implement Least Privilege. Is it best to create groups explicitly denying specific actions and allowing everything else, or creating groups that allow only the specific actions needed? AWS's Policy evaluation logic is a little bit different than I'm used too.

For Instance, say I want the following affect.

1. Some Admins can do anything except access IAM (Powerusers) or makes changes to CloudFormation.
2. Some Admins can do anything except access IAM.
3. Some Admins can do anything.

Would it be best to design this way:

Admins: Can do anything. AdminsNoIAM: Can do anything with explicit deny to IAM. AdminsNoCloudFormation: Can do anything with explicit deny to CloudFormation.

OR

Admins: Can do anything. AdminsLimited: Can do anything explicitly listed, cloudformation and IAM not listed. CloudFormationAdmins: Explicitly allows CloudFormation access.

It seems like the first option would be the simplest to implement, but it feels like it might get a bit clunky. I may just not be used to the way AWS handles explicit denies. Thanks!

Answer 1

IAM users have no permissions by default, you have to add them to a group or grant them permissions before they can do anything. This shows AWS IAM denies by default, unless explicitly allowed.

You're best off only adding permissions that an individual user or group requires. Everything else will be denied by default by IAM. If you wanted to grant everything the deny you'd be going against best practice and the way AWS has set up IAM.

Also, as ceejayoz pointed out, new features are regularly added, so you'd be continually updating policies if you allow by default.