IMPLEMENTING SECURITY INVARIANTS IN AN AWS MANAGEMENT ACCOUNT

Summary from the TLDR InfoSec newsletter

A Permission Boundary defines the maximum permissions that can be applied to a given principal. In an AWS management account, permissions boundaries are necessary because SCPs cannot be applied. This post introduces a set of security invariants that should be true in an AWS management account and provides an IAM policy to enforce them. It also links to a Lambda function that can be used to attach the policy to all newly created IAM principals.