Attribute-based access control (ABAC) is an authorization model that allows users to define access policies based on attributes associated with IAM principals and AWS resources. The ABAC model allows users to use attributes like tags to make access control decisions.
In this Cloud Lab, you’ll create an IAM group and attach an attribute-based access policy that allows the users in the group to assume only the roles with the same attributes as the user. You’ll then add users in the IAM group with different attributes. You’ll also create two roles with different attributes and attach an attribute-based access policy for accessing Lambda functions with similar attributes. Afterward, you’ll try to assume each role with both users.
You’ll also create two Lambda functions with different attributes. To conclude the Cloud Lab, you’ll access both the Lambda functions with both users.
The following is the high-level architecture diagram of the infrastructure that you’ll create in this Cloud Lab:
