AK/SK泄漏后如何禁用权限

在发现AK/SK泄漏后应立即回收权限，避免风险扩散。因此针对不同的泄漏回收方式如下：

Identity Center用户权限泄漏

当AWS Identity Center用户权限泄漏时，首先应立即在AWS Identity Center中删除受泄漏影响的用户会话。并且立即重置用户的密码，添加MFA。如果之前绑定了MFA设备也可以删除后重新绑定。也可以暂时禁用用户访问权限，调查清楚影响都被解决后再恢复。

但是注意需要至少1个小时才能回收用户的权限：https://docs.aws.amazon.com/singlesignon/latest/userguide/authconcept.html#sessionsconcept

When you disable or delete a user in IAM Identity Center, that user will immediately be prevented from signing in to create new IAM Identity Center sign in sessions. IAM Identity Center sign in sessions are cached for one hour, which means that when you disable or delete a user while they have an active IAM Identity Center sign in session, their existing IAM Identity Center sign in session will continue for up to an hour, depending on when the sign in session was last refreshed. During this time, the user can initiate new IAM Identity Center application and IAM role sessions.

添加SCP来限制用户的所有访问请求行为，SCP挂到整个组织上。SCP示例代码如下：

关于SCP请求者的condition条件如何写可以参考：https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#policy-vars-infotouse

IAM Identity Center用户填写的aws:userid可以从cloudtrail中查询到，

• 在 CloudTrail 日志中查找 type 设置为 AssumedRole 的 userIdentity 元素。

• userIdentity 元素中的 principalId 字段就是需要填写到"aws:userid"的内容。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "aws:userid": "AROASG3QY4E3OTDKZLEMQ:auditor"
        }
      }
    }
  ]
}

IAM用户AK/SK泄漏

最好是通过SCP来限制用户的所有访问请求行为，SCP挂到整个组织上。SCP示例代码如下：

为了限制特定IAM用户（如John）对所有AWS服务的访问，可以使用AWS服务控制策略（SCP）。下面的示例SCP展示了如何拒绝所有与标识符匹配"[e-mail]"的IAM用户的操作。将此策略附加到您的AWS组织或特定组织单位（OU）后，可以确保指定用户无法执行任何操作，有效防止在凭证泄露后的未经授权活动风险。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "aws:userid": "*:[e-mail]"
        }
      }
    }
  ]
}

或者也可以在泄漏的IAM用户所绑定的权限中设置Permission Set，待影响解除后去掉添加的Permission Set就可以恢复原来的权限：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*"
    }
  ]
}