taleliyahu / startup-aws-iam-roles Goto Github PK

Business, Tech and Ops policy groups for all set of roles for any size startup.

With current policy structure, there is no deny statement when a user is not using MFA which means that if another policy gets attached (like administrator for example), they will be able to modify resources in AWS without MFA.

Using a deny when the MFA is not present will overrule any Allow statements.

Fine tuning required for few * wide open roles

To control who in the organization has permission to create and manage security groups and network ACLs (NACL). We need to Isolate the responsibilities and roles for better defense. For example, we can give only network administrators or security admin the permission to manage the security groups and restrict other roles.

API like below should be restricted to prevent any mishappening:
ec2:StopInstances,
ec2:TerminateInstances, etc.

Creating 3 different groups for startups with 4 people, 12 people and 40+ (current one designed for 40+ people startup)