I am trying to create the appropriate AWS IAM Groups to implement Least Privilege. Is it best to create groups explicitly denying specific actions and allowing everything else, or creating groups that allow only the specific actions needed? AWS's Policy evaluation logic is a little bit different than I'm used too.
For Instance, say I want the following affect.
- Some Admins can do anything except access IAM (Powerusers) or makes changes to CloudFormation.
- Some Admins can do anything except access IAM.
- Some Admins can do anything.
Would it be best to design this way:
Admins: Can do anything.
AdminsNoIAM: Can do anything with explicit deny to IAM.
AdminsNoCloudFormation: Can do anything with explicit deny to CloudFormation.
OR
Admins: Can do anything.
AdminsLimited: Can do anything explicitly listed, cloudformation and IAM not listed.
CloudFormationAdmins: Explicitly allows CloudFormation access.
It seems like the first option would be the simplest to implement, but it feels like it might get a bit clunky. I may just not be used to the way AWS handles explicit denies. Thanks!