Noam Dahan

@noamdahan.bsky.social

88 Followers 66 Following

Cloud security researcher at CrowdStrike, European Universities Debating Champion (for my sins). My 5th grade teacher said I was disruptive.

VS Code screenshot: { "Version": "2012-10-17", "Statement": [ { "Sid": "EnforceOrgIdentities", "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": [ "arn:aws:s3:::AwesomeCats-af4v81b2", "arn:aws:s3:::AwesomeCats-af4v81b2/*" ], "Condition": { "StringNotEqualsIfExists": { "aws:PrincipalOrgID": "<my-org-id>", "aws:PrincipalAccount": [ "<load-balancing-account-id>", "<fin-space-account-id>", "<third-party-account-a>", "<third-party-account-b>" ], "aws:ResourceTag/dp:exclude:identity": "true" }, "BoolIfExists": { "aws:PrincipalIsAWSService": "false" } } } ] }
A complex flowchart diagram illustrating AWS Permission Evaluation with Resource Control Policies (RCPs). The chart is divided into several sections, each representing different stages of the permission evaluation process. The flowchart begins with "Deny evaluation" at the top, leading to a series of decision points represented by diamond shapes. These decision points evaluate various conditions, such as the presence of explicit Deny policies, organization resource control policies (RCP), and service control policies (SCP). The chart then branches into sections for "Resource-based policies" and "Identity-based policies". Each section contains multiple decision points and paths, leading to potential outcomes of "Allow" or "Deny (implicit deny)". The Resource-based policies section includes checks for session, role, and account permissions of the calling principal. The Identity-based policies section evaluates identity-based policies and permissions boundaries. At the bottom of the chart, there's a section for "Session policies" which includes checks for federated users and session policies.