framework
AWS Identity and Access Management (IAM) is Amazon Web Services' service for managing users, roles, and policies controlling access to AWS resources.
No evidence-backed relationships are recorded.
One SCP deny line blocked an AdministratorAccess session in a scratch AWS account, according to a dev.to guide to sandboxing coding agents. Its three gaps, the management account, service-linked roles and outside principals admitted by resource policies, set where an agent can run.
Reality
Bala Paranj ran a 2022 AWS privilege-escalation case through a Z3 solver and found its six-action deny policy blocked four of nine compute-launch vectors. Expanding the list to all nine leaves a residual, because each new compute service AWS ships opens a fresh bypass path.
Reality
AWS lets an S3 presigned URL live up to seven days, and anyone holding a leaked one can use it until it expires or its signer is revoked. Revoking the signer kills every URL it made, so short expiries and a bucket-level cap on signature age are the practical defence.
Reality
Truffle Security retested 10,616 publicly leaked AWS credentials and 88 percent still authenticated. The median key was about five years old and had no successor.
Perspective Coverage
5 publishersReality
Signing up now takes a Google, GitHub or Apple identity and, for most new customers, no card, with $100 in credits. Each project is a real AWS account carrying a monthly ceiling from $20 that AWS enforces by stopping the work.
Reality
A dev.to account of two AccessDenied failures shows CloudFormation resource providers making supporting calls into adjacent services, so an execution role scoped to the template's service namespaces is incomplete by construction.
Reality
Permission-by-permission review scores iam:PassRole, lambda:CreateFunction and lambda:InvokeFunction as controlled access, while path analysis sees one route to whatever the passed role holds. Three policy layers decide whether that route is live.
Reality
A tester gave AWS DevOps Agent a broad elevated role and found its temporary session policy admits only supported actions, while an SSM document that accepts arbitrary package names still installed tmux after one approval.
Reality
Unit 42 traced AWSCompromisedKeyQuarantine through three versions since August 2020 and documented the GitHub secret scanning integration that lets AWS attach the policy to an exposed IAM user automatically, with the owner notified afterwards.
Reality
miruky's console walkthrough puts an order and its outbox event in one DynamoDB transaction, then fails the consumer on purpose to show why redelivery is the consumer's problem. The whole exercise is priced under $5 in us-east-1.
Reality
The ESP32-S3 example generates the device key on the chip and sends only a CSR to AWS IoT Core. The credential that gets it there is a claim certificate and private key copied into the SPIFFS image every unit shares.
Reality
A dev.to walkthrough says AWS App Runner no longer accepts new services, and the Amazon ECS Express Mode path it demonstrates opens with an execution role, an infrastructure role, and a public container image.
Reality
Taking the password out of a Lambda's environment variables costs five console steps and one inline rds-db:connect policy, and buys a database credential that expires fifteen minutes after boto3 mints it.
Reality
New AWS sign-ups federate to a Google, GitHub or Apple login and arrive as a project whose resource permissions are set by the console and by whatever coding agent the owner pastes AWS's setup text into. The rollout covers new customers only.
Reality
AWS's landing zone guidance for the European Sovereign Cloud starts at the partition boundary. Credentials in aws-eusc cannot reach resources in aws, so the centralisation an operator already runs gets built a second time inside the new partition.
Reality
Trust Boundary's walkthrough of the 2019 Capital One breach puts the weight on the IAM role attached to the firewall instance, and says the OCC consent order that followed does not mention server-side request forgery at all.
Reality
IAM Access Analyzer already names the unused permissions and writes the tightened policy. A new AWS pattern sorts each finding by how the role was created and files the fix as a pull request or an issue.
Reality
AgentCore Identity now hosts the redirect leg and keeps the tokens, and what you configure in exchange is an OIDC application in your corporate IdP, a service role, and AWS's callback URL inside your GitHub and Slack apps.
Reality
Google's Custom Search JSON API is closed to new customers and stops working on January 1, 2027. One builder replaced it with Amazon Bedrock AgentCore Web Search and paid a 40 percent premium to keep the tool under IAM.
Reality
Unit 42 committed a fresh, overly permissive AWS key to a random GitHub repository with the usual quarantine policy switched off, then timed how long a cryptojacking crew took to find it and start mining.
Reality
Build · September 11, 2026 · 1 publisher
Build · September 11, 2026 · 1 publisher
Build · September 11, 2026 · 1 publisher
Build · September 10, 2026 · 1 publisher
Build · September 8, 2026 · 1 publisher
Build · September 3, 2026 · 1 publisher
Build · September 1, 2026 · 1 publisher
Build · September 1, 2026 · 1 publisher
Build · August 27, 2026 · 1 publisher
Build · August 27, 2026 · 1 publisher
Build · August 23, 2026 · 1 publisher
Build · August 23, 2026 · 1 publisher
Build · August 22, 2026 · 1 publisher
Build · August 22, 2026 · 1 publisher
Leadership · August 20, 2026 · 1 publisher
Build · August 19, 2026 · 1 publisher
Build · August 18, 2026 · 1 publisher
Build · August 15, 2026 · 1 publisher