1
{
2
  "Version": "2012-10-17",
3
  "Statement": [
4
    {
5
      "Sid": "AllowEC2Management",
6
      "Effect": "Allow",
7
      "Action": [
8
        "ec2:StartInstances",
9
        "ec2:StopInstances",
10
        "ec2:DescribeInstances"
11
      ],
12
      "Resource": "arn:aws:ec2:*:*:instance/*",
13
      "Condition": {
14
        "StringEquals": {
15
          "aws:RequestedRegion": ["us-east-1", "eu-west-1"]
16
        }
17
      }
18
    }
19
  ]
20
}

1
# 错误：过度权限
2
{
3
    "Effect": "Allow",
4
    "Action": "*",
5
    "Resource": "*"
6
}
7

8
# 正确：精确权限
9
{
10
    "Effect": "Allow",
11
    "Action": [
12
        "s3:GetObject",
13
        "s3:PutObject"
14
    ],
15
    "Resource": "arn:aws:s3:::my-bucket/my-prefix/*"
16
}

1
{
2
  "Effect": "Allow",
3
  "Action": "sts:AssumeRole",
4
  "Resource": "arn:aws:iam::123456789:role/MyRole",
5
  "Condition": {
6
    "IpAddress": {
7
      "aws:SourceIp": "10.0.0.0/8"
8
    },
9
    "Bool": {
10
      "aws:MultiFactorAuthPresent": "true"
11
    },
12
    "StringEquals": {
13
      "aws:RequestedRegion": ["us-east-1", "us-west-2"]
14
    }
15
  }
16
}

1
{
2
  "Version": "2012-10-17",
3
  "Statement": [
4
    {
5
      "Effect": "Allow",
6
      "Action": ["s3:*", "ec2:Describe*"],
7
      "Resource": "*"
8
    }
9
  ]
10
}

1
factors = {
2
    "知识因素": ["密码", "PIN 码", "安全问题"],
3
    "持有因素": ["手机", "硬件令牌", "智能卡"],
4
    "固有因素": ["指纹", "面部识别", "虹膜"]
5
}
6

7
# 安全性排序
8
# 1. FIDO2/WebAuthn 硬件令牌 - 最安全
9
# 2. TOTP 软件令牌 - 较安全
10
# 3. SMS 验证码 - 中等安全（SIM 劫持风险）
11
# 4. 邮件验证码 - 较弱

1
{
2
  "Version": "2012-10-17",
3
  "Statement": {
4
    "Effect": "Deny",
5
    "Action": "*",
6
    "Resource": "*",
7
    "Condition": {
8
      "Bool": {
9
        "aws:MultiFactorAuthPresent": "false"
10
      }
11
    }
12
  }
13
}

1
{
2
  "Version": "2012-10-17",
3
  "Statement": [
4
    {
5
      "Effect": "Allow",
6
      "Principal": {
7
        "Federated": "arn:aws:iam::123456789:saml-provider/MySamlProvider"
8
      },
9
      "Action": "sts:AssumeRoleWithSAML",
10
      "Condition": {
11
        "StringEquals": {
12
          "SAML:aud": "https://signin.aws.amazon.com/saml"
13
        }
14
      }
15
    }
16
  ]
17
}

1
# 1. 启用 MFA
2
aws iam enable-mfa-device \
3
  --user-name alice \
4
  --serial-number arn:aws:iam::123456789:mfa/alice
5

6
# 2. 创建组而不是直接分配权限
7
aws iam create-group --group-name Developers
8

9
# 3. 使用角色进行跨账户访问
10
aws sts assume-role \
11
  --role-arn arn:aws:iam::123456789:role/CrossAccountRole \
12
  --role-session-name dev-session

1
# 检查未使用的权限
2
aws iam simulate-principal-policy \
3
  --policy-source-arn arn:aws:iam::123456789:user/alice \
4
  --action-names s3:* \
5
  --resource-arns arn:aws:s3:::bucket
6

7
# 生成权限报告
8
aws iam generate-service-last-accessed-details \
9
  --arn arn:aws:iam::123456789:user/alice