Cloud Security Maturity Model·AWS v3.0.0

Drag to explore · pinch to zoom
Home / Matrix / Identity and access management / c4.3
Optimized Identity and access management

c4.3 Enforce IAM data perimeters

A data perimeter is a set of always-on guardrails ensuring only trusted identities access trusted resources from expected networks. Built from SCPs, RCPs, and VPC endpoint policies, it protects data across many accounts against misconfiguration and stolen credentials.

Implementation guidance

What a data perimeter is

As cloud operations decentralize, data perimeters on AWS reduce the risk of misconfiguration and unintended data access. A data perimeter is a set of organization-wide, always-on permission guardrails that ensure:

  • Trusted identities — principals in your accounts, or AWS services acting for you —
  • access trusted resources — owned by your accounts or AWS services —
  • from expected networks — your VPCs and on-premises networks.

These guardrails do not replace fine-grained access controls; they enforce security invariants so you can advance the least-privilege journey more safely.

How to build it

Combine Service Control Policies, Resource Control Policies, and VPC endpoint policies, using IAM condition keys (such as aws:PrincipalOrgID, aws:ResourceOrgID, and aws:SourceVpc). Treat it as any security control: run a threat analysis, then implement perimeter controls iteratively based on your risk criteria. The data perimeter guidance and the Data Perimeter workshop walk through each perimeter type.

How it fits together

Trusted identities aws:PrincipalOrgID Trusted resources aws:ResourceOrgID Expected networks aws:SourceVpc allowed access Built from Service Control Policies (SCP) Resource Control Policies (RCP) VPC endpoint policies always-on, org-wide guardrails
A data perimeter is the always-on intersection of three invariants — trusted identities, trusted resources, and expected networks — enforced with SCPs, RCPs, and VPC endpoint policies using IAM condition keys. Only access that satisfies all three is allowed.

How to validate

  • Are data perimeters enforced to protect critical resources?
  • Have you used RCPs to prevent access to your resources from outside your organization?
  • Do IAM condition keys ensure access to critical resources (such as S3 buckets) is allowed only from expected identities and networks?

Threats addressed

  • Configuration mistakes in identity- or resource-based policies can leave data reachable by untrusted identities or from unexpected networks.
  • Stolen or non-corporate credentials can be used to access your resources if no perimeter restricts where and by whom they can be used.

AWS services

AWS Organizations AWS IAM

Pricing

No additional charge

IAM, SCPs, and RCPs are offered at no additional charge.

Framework mappings

AWS CAF

Well-Architected

NIST CSF

References