All entry text is from the AWS Glossary Version 1.0.
This glossary is a Addendum to the research on AWS privilege escalation by Gerben Kleijn.
account |
A formal relationship with AWS that is associated with all of the following:
|
allow |
One of two possible outcomes (the other is deny) when an IAM access policy is evaluated. When a user makes a request to AWS, AWS evaluates the request based on all permissions that apply to the user and then returns either allow or deny. |
AssumeRolePolicy |
A synonym for the Trust policy. |
group |
A collection of IAM users. You can use IAM groups to simplify specifying and managing permissions for multiple users. |
NotAction |
An advanced policy element that explicitly matches everything except the specified list of actions. |
permission |
A statement within a policy that allows or denies access to a particular resource. You can state any permission like this: "A has permission to do B to C." For example, Jane (A) has permission to read messages (B) from John's Amazon SQS queue (C). Whenever Jane sends a request to Amazon SQS to use John's queue, the service checks to see if she has permission. It further checks to see if the request satisfies the conditions John set forth in the permission. |
policy |
For IAM: A document defining permissions that apply to a user, group, or role; the permissions in turn determine what users can do in AWS. A policy typically allows access to specific actions, and can optionally grant that the actions are allowed for specific resources, like EC2 instances, Amazon S3 buckets, and so on. Policies can also explicitly deny access. |
principal |
The user, service, or account that receives permissions that are defined in a policy. The principal is A in the statement "A has permission to do B to C." |
resource |
An entity that users can work with in AWS, such as an EC2 instance, an Amazon DynamoDB table, an Amazon S3 bucket, an IAM user, an AWS OpsWorks stack, and so on. |
role |
A tool for giving temporary access to AWS resources in your AWS account. |
Trust policy |
An IAM policy that is an inherent part of an IAM role. The trust policy specifies which principals are allowed to use the role. (Synonym for AssumeRolePolicy). |
user |
A person or application under an account that needs to make API calls to AWS products. Each user has a unique name within the AWS account, and a set of security credentials not shared with other users. These credentials are separate from the AWS account's security credentials. Each user is associated with one and only one AWS account. |
versioning |
Every object in Amazon S3 has a key and a version ID. Objects with the same key, but different version IDs can be stored in the same bucket. Versioning is enabled at the bucket layer using PUT Bucket versioning. |
Subscribe to Bishop Fox's Security Blog
Be first to learn about latest tools, advisories, and findings.
Thank You! You have been subscribed.
