The Policy Explosion Problem
In a traditional Role-Based Access Control (RBAC) model, you create a role for every combination of team and permission level: RedTeamS3ReadRole, BlueTeamS3ReadRole, GreenTeamS3ReadRole, RedTeamEC2AdminRole, and so on. With 10 teams and 5 permission levels, you need 50 roles. With 50 teams, you need 250. Every new team requires a policy update. This is operationally unsustainable.
Attribute-Based Access Control (ABAC) replaces this combinatorial explosion with a single, reusable policy that makes decisions based on tags — metadata attached to both the identity and the resource.
How ABAC Works
The core idea: "Allow this action if the requester's tag matches the resource's tag."
Tag the IAM User or Role:
// Tag on IAM User "bob"
{ "Department": "red-team" }
Tag the EC2 instances: Apply the same key to the servers themselves — for example, tagging an instance with Department=red-team via the EC2 API.
Write one policy that works for everyone:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["ec2:StartInstances", "ec2:StopInstances"],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/Department": "${aws:PrincipalTag/Department}"
}
}
}
]
}
The ${aws:PrincipalTag/Department} is a policy variable — it resolves at evaluation time to the value of the Department tag on the requesting identity. The condition then checks whether the resource's Department tag matches.
Result:
| User | User Tag | Target Instance Tag | Outcome |
|---|---|---|---|
| Bob | Dept=red-team |
Dept=red-team |
✅ Allowed |
| Bob | Dept=red-team |
Dept=blue-team |
❌ Denied |
| Alice | Dept=blue-team |
Dept=blue-team |
✅ Allowed |
When a new team joins, you tag their user and their resources. No policy changes required.
The operational trade-off: ABAC shifts the security boundary from policy management to tag management. If tags are applied inconsistently or can be modified by users themselves, the access control breaks down. In production, tag governance — enforcing mandatory tags via SCPs and preventing users from modifying their own principal tags — is essential for ABAC to be trustworthy.