Glossary of Relevant AWS Terms

Bishop Fox Research Priv Esc Method AWS

Share

All entry text is from the AWS Glossary Version 1.0.

This glossary is a Addendum to the research on AWS privilege escalation by Gerben Kleijn.

account

A formal relationship with AWS that is associated with all of the following:
  • The owner email address and password
  • The control of resources created under its umbrella
  • Payment for the AWS activity related to those resources

allow

One of two possible outcomes (the other is deny) when an IAM access policy is evaluated. When a user makes a request to AWS, AWS evaluates the request based on all permissions that apply to the user and then returns either allow or deny.
AssumeRolePolicy A synonym for the Trust policy.

group

A collection of IAM users. You can use IAM groups to simplify specifying and managing permissions for multiple users.
NotAction An advanced policy element that explicitly matches everything except the specified list of actions.

permission

A statement within a policy that allows or denies access to a particular resource. You can state any permission like this: "A has permission to do B to C." For example, Jane (A) has permission to read messages (B) from John's Amazon SQS queue (C). Whenever Jane sends a request to Amazon SQS to use John's queue, the service checks to see if she has permission. It further checks to see if the request satisfies the conditions John set forth in the permission.

policy

For IAM: A document defining permissions that apply to a user, group, or role; the permissions in turn determine what users can do in AWS. A policy typically allows access to specific actions, and can optionally grant that the actions are allowed for specific resources, like EC2 instances, Amazon S3 buckets, and so on. Policies can also explicitly deny access.

principal

The user, service, or account that receives permissions that are defined in a policy. The principal is A in the statement "A has permission to do B to C."

resource

An entity that users can work with in AWS, such as an EC2 instance, an Amazon DynamoDB table, an Amazon S3 bucket, an IAM user, an AWS OpsWorks stack, and so on.

role

A tool for giving temporary access to AWS resources in your AWS account.

Trust policy

An IAM policy that is an inherent part of an IAM role. The trust policy specifies which principals are allowed to use the role. (Synonym for AssumeRolePolicy).

user

A person or application under an account that needs to make API calls to AWS products. Each user has a unique name within the AWS account, and a set of security credentials not shared with other users. These credentials are separate from the AWS account's security credentials. Each user is associated with one and only one AWS account.

versioning

Every object in Amazon S3 has a key and a version ID. Objects with the same key, but different version IDs can be stored in the same bucket. Versioning is enabled at the bucket layer using PUT Bucket versioning.

Gerben kleijn

About the author, Gerben Kleijn

Managing Security Consultant

Gerben Kleijn (OSCP, CISSP) is a Managing Security Consultant for Bishop Fox, where he primarily focuses on external network penetration tests and web application assessments, as well as cloud deployment reviews for Amazon Web Services (AWS). He has advised Fortune 500 brands and startups in industries such as media, retail, and software in addition to popular websites, credit reporting agencies, and marketing platforms.

More by Gerben

This site uses cookies to provide you with a great user experience. By continuing to use our website, you consent to the use of cookies. To find out more about the cookies we use, please see our Privacy Policy.