IAM Across Clouds

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3ReadOnly",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "us-east-1"
        },
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        }
      }
    }
  ]
}

# Create a custom IAM policy
aws iam create-policy \
  --policy-name S3ReadOnlyMFA \
  --policy-document file://policy.json

# Attach policy to a role
aws iam attach-role-policy \
  --role-name MyAppRole \
  --policy-arn arn:aws:iam::123456789012:policy/S3ReadOnlyMFA

# Create an SCP (Organization-level guardrail)
aws organizations create-policy \
  --name DenyRegionsOutsideUS \
  --type SERVICE_CONTROL_POLICY \
  --content '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestedRegion":["us-east-1","us-west-2"]}}}]}'

# List built-in roles
az role definition list --output table --query "[?roleType=='BuiltInRole'].{Name:roleName, Description:description}" | head -20

# Assign a role at subscription scope
az role assignment create \
  --assignee "user@example.com" \
  --role "Reader" \
  --scope "/subscriptions/SUBSCRIPTION_ID"

# Assign a role at resource group scope
az role assignment create \
  --assignee "user@example.com" \
  --role "Contributor" \
  --scope "/subscriptions/SUBSCRIPTION_ID/resourceGroups/my-rg"

# Create a custom role
az role definition create --role-definition '{
  "Name": "Storage Blob Data Reader Custom",
  "Description": "Read blob data with IP restriction",
  "Actions": [
    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
  ],
  "NotActions": [],
  "DataActions": [
    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
  ],
  "AssignableScopes": ["/subscriptions/SUBSCRIPTION_ID"]
}'

# Grant a role at project level
gcloud projects add-iam-policy-binding MY_PROJECT \
  --member="user:developer@example.com" \
  --role="roles/storage.objectViewer"

# Grant a role at folder level (inherited by all projects in folder)
gcloud resource-manager folders add-iam-policy-binding FOLDER_ID \
  --member="group:developers@example.com" \
  --role="roles/viewer"

# Create a custom role
gcloud iam roles create storageReaderCustom \
  --project=MY_PROJECT \
  --title="Storage Reader Custom" \
  --description="Read objects from Cloud Storage" \
  --permissions="storage.objects.get,storage.objects.list,storage.buckets.get" \
  --stage=GA

# Add an IAM condition (restrict access by resource attribute)
gcloud projects add-iam-policy-binding MY_PROJECT \
  --member="user:developer@example.com" \
  --role="roles/storage.objectViewer" \
  --condition='expression=resource.name.startsWith("projects/_/buckets/staging-"),title=staging-only,description=Only access staging buckets'

# Create an IAM deny policy (prevents even if allowed elsewhere)
gcloud iam policies create deny-external-sharing \
  --attachment-point="cloudresourcemanager.googleapis.com/projects/MY_PROJECT" \
  --kind=denypolicies \
  --policy-id=deny-external-sharing

# OCI policy syntax: Allow <subject> to <verb> <resource-type> in <location> where <conditions>

# Create a policy allowing a group to manage instances in a compartment
oci iam policy create \
  --compartment-id TENANCY_OCID \
  --name "compute-admins-policy" \
  --description "Allow compute admins to manage instances" \
  --statements '[
    "Allow group ComputeAdmins to manage instance-family in compartment Production",
    "Allow group ComputeAdmins to use virtual-network-family in compartment Production",
    "Allow group ComputeAdmins to read app-catalog-listing in tenancy"
  ]'

# OCI uses four permission verbs: inspect, read, use, manage
# manage > use > read > inspect (each includes the lesser verbs)

# AWS: Create an IAM role for an EC2 instance
aws iam create-role \
  --role-name MyAppRole \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"Service": "ec2.amazonaws.com"},
      "Action": "sts:AssumeRole"
    }]
  }'
aws iam create-instance-profile --instance-profile-name MyAppProfile
aws iam add-role-to-instance-profile \
  --instance-profile-name MyAppProfile --role-name MyAppRole

# Azure: Create a user-assigned managed identity
az identity create \
  --name my-app-identity \
  --resource-group my-rg
az vm identity assign \
  --name my-vm \
  --resource-group my-rg \
  --identities my-app-identity

# GCP: Create a service account and assign to VM
gcloud iam service-accounts create my-app-sa \
  --display-name="My Application Service Account"
gcloud projects add-iam-policy-binding MY_PROJECT \
  --member="serviceAccount:my-app-sa@MY_PROJECT.iam.gserviceaccount.com" \
  --role="roles/storage.objectViewer"
gcloud compute instances set-service-account my-vm \
  --service-account=my-app-sa@MY_PROJECT.iam.gserviceaccount.com \
  --scopes=cloud-platform

# OCI: Use instance principal (no key management needed)
# Instance principals are configured via dynamic groups
oci iam dynamic-group create \
  --compartment-id TENANCY_OCID \
  --name "app-instances" \
  --description "Application compute instances" \
  --matching-rule "Any {instance.compartment.id = 'COMPARTMENT_OCID'}"

# AWS: Check for overly permissive policies
aws accessanalyzer create-analyzer \
  --analyzer-name my-analyzer \
  --type ACCOUNT

aws accessanalyzer list-findings \
  --analyzer-arn ARN \
  --filter '{"status": {"eq": ["ACTIVE"]}}'

# GCP: Use IAM Recommender to find excess permissions
gcloud recommender recommendations list \
  --project=MY_PROJECT \
  --location=global \
  --recommender=google.iam.policy.Recommender \
  --format="table(name,description,primaryImpact)"

# Azure: Review access with Privileged Identity Management
az ad pim role assignment list \
  --resource-type subscription \
  --resource-id SUBSCRIPTION_ID