Zero Trust: IAM Auth Policies

Security Groups are NOT Identity

In standard AWS networking, access control between services is enforced by Security Groups. A Security Group rule says: "Allow inbound TCP port 443 from 10.1.2.3." This is network-identity-based authorization — you are trusted because of where you are (your IP address), not who you are.

This model has a fundamental weakness: IP addresses are not stable identity. Instances are replaced, IPs are reassigned, and in a containerized environment, pod IPs change constantly. More critically, if an attacker compromises any host on the allowed IP range, they inherit that host's network access to every service that trusts that IP. This is the opposite of Zero Trust.

IAM-Based Authorization

Lattice replaces IP-based authorization with IAM Auth Policies — the same identity model used for every other AWS API call.

How it works:

1. The client signs the request. The calling service (e.g., a Lambda function with IAM Role BillingApp-Role) signs its outgoing HTTP request using AWS Signature Version 4 (SigV4). SigV4 is the standard signing mechanism for all AWS API calls — it creates a cryptographic signature using the caller's AWS credentials and includes it in the Authorization HTTP header.

2. Lattice verifies the signature. When the request arrives at the Lattice proxy, Lattice validates the SigV4 signature against AWS IAM. This confirms the caller's identity cryptographically.

3. Lattice evaluates the Auth Policy. Each Lattice Service has an attached Auth Policy — a JSON document identical in structure to an IAM resource policy. Example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/BillingApp-Role"
      },
      "Action": "vpc-lattice-svcs:Invoke",
      "Resource": "*"
    }
  ]
}

1. If the policy allows it, the request is forwarded. If not, Lattice returns a 403 Forbidden before the request ever reaches your application code.

The Zero Trust result: Even if an attacker gains network access to a VPC associated with the Service Network, they cannot call protected services without valid AWS credentials for an authorized IAM role. Network position grants zero implicit trust. Every request must prove its identity.

Auth modes: Lattice supports three auth modes per service:
- NONE — No auth required (useful for internal dev environments or public-facing services).
- AWS_IAM — SigV4 signing required; auth policy evaluated.
- Auth policy can also use Condition blocks to restrict by VPC, VPC endpoint, or organization.