AWS IAM does not remove the network perimeter. It changes what a network boundary is asked to prove. In AWS’s data-perimeter model, access is expected to involve a trusted identity, a trusted resource, and an expected network at the same time. The network is one of those three conditions, so the castle wall becomes one check among several instead of the check that decides access on its own.
This article explains what a data perimeter is, which policy types enforce each part, where the guardrails stop, and what to plan for before you rely on the model.
As an Amazon Associate I earn from qualifying purchases.
What an AWS data perimeter is
An AWS data perimeter is a set of organization-level guardrails that describe which identities, resources, and networks are expected to take part in access to your data. AWS describes these controls as coarse-grained. They define boundaries around access; they do not grant it.
The model reduces to three questions:
- Is the identity trusted? In practice this means principals that belong to your AWS organization.
- Is the resource trusted? This means resources owned by your organization, for example checked with the
aws:ResourceOrgIDcondition key in a service control policy. - Is the network expected? The request arrives from an IP range, a VPC, or a VPC endpoint you have declared as expected.
AWS’s perimeter whitepaper states the requirement as a formula: Access in the Perimeter ⇒ (Trusted Identity) ∧ (Trusted Resource) ∧ (Expected Network). Meeting all three conditions is necessary for access inside the perimeter, but it is not sufficient. Identity and resource permissions still have to allow the action.
#1 Best Overall
Why the network stays in the model
The word “replaces” overstates the change. A network boundary can confirm where a request came from, but it cannot confirm who is calling or what they are calling. The three-part model adds those checks without discarding the network check.
Consider a request made with valid credentials, from inside an expected VPC, against a bucket in an account outside your organization. A network-only control would pass it. The trusted-resource condition fails it. The perimeter catches the case because the network is one input among three, not the only one.
Network context also remains enforceable. The network keys described later in this article are used in the same guardrails that check identity and resource.
Which policy layer enforces what
The perimeter is built from four policy types. Each attaches at a different enforcement point, so each covers a different part of the request path.
| Policy layer | Where it attaches | What it constrains | Example keys from AWS guidance | Limit to remember |
|---|---|---|---|---|
| Service control policies (SCPs) | AWS Organizations, applied to principals in member accounts | Which resources identities may reach, and from which networks they may make requests | aws:ResourceOrgID, aws:SourceIp, aws:SourceVpc, aws:ViaAWSService |
Restricts principals; does not grant an action |
| Resource control policies (RCPs) | Organization-level guardrails on the resource side | Which principals and networks can reach covered resources | aws:PrincipalOrgID, aws:SourceVpc |
Service principals and service-mediated requests need considered exceptions |
| VPC endpoint policies | An individual VPC endpoint | Principals and resources reachable through that endpoint | Scope is defined by the endpoint itself | Does not replace identity policies or destination resource policies |
| Resource-based policies | The resource itself | Direct permissions on the resource, and guardrails where RCP support is unavailable | Depends on the resource’s own policy statements | Needed for resources an RCP does not cover; not a universal substitute for the other layers |
Read the table as a division of responsibility. An SCP can stop an identity from calling a resource outside the organization. An RCP can stop a principal from outside the organization reaching your resource. An endpoint policy narrows what can pass through one endpoint. A resource-based policy states what the resource itself allows. No single layer covers all three perimeter conditions.
What the guardrails do not do
Several misreadings are common enough to address directly.
- They do not replace fine-grained access control. AWS’s IAM documentation states: “These organization-wide permissions guardrails do not replace your existing fine-grained access controls.” Keep identity policies and resource policies that grant the specific actions you need.
- They do not grant permissions. A guardrail that allows a request has not authorized the action. Something else must still permit it.
- An endpoint policy is not a substitute for other policies. It adds a boundary for traffic that crosses its endpoint. Identity policies and destination resource policies still apply.
- No single policy type is the perimeter. The perimeter is the combination of the layers in the table above.
Network condition keys and their limits
AWS documents six condition keys for expressing expected networks:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
aws:SourceIp: the IP address the request came from.aws:SourceVpc: the VPC the request originated in.aws:SourceVpce: the VPC endpoint the request passed through.aws:VpceAccount: the account that owns the VPC endpoint.aws:VpceOrgPaths: the organization path of the endpoint owner.aws:VpceOrgID: the organization of the endpoint owner.
The last three keys are tied to who owns the endpoint rather than where the request sits. AWS says they can scale with endpoint usage, but recommends using them only when every service you are restricting supports them. Where broader service support is needed, AWS suggests considering aws:SourceVpc and aws:SourceVpce instead. Check the current service support list in AWS’s documentation before you copy a policy, because support changes over time.
Service access paths that need explicit exceptions
AWS services sometimes reach your resources on your behalf, using service principals or forwarded access sessions. A perimeter written only around the principal’s organization and network can block these legitimate paths.
AWS documents two keys for handling them:
aws:ViaAWSServiceidentifies requests an AWS service made on a principal’s behalf.aws:PrincipalIsAWSServiceidentifies requests whose calling principal is an AWS service.
Overly broad denials can break valid service workflows. A deny written only around network origin, for instance, may stop a service request that legitimately arrives over an AWS-managed network path. Make each exception explicit, scope it to the service and action it serves, and review it on a schedule.
Rolling out a perimeter in order
AWS recommends treating a data perimeter as part of your security risk-management program rather than a one-time configuration. A practical sequence:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Map intended access patterns and threats. Record which identities, resources, and networks should legitimately interact, and which access paths you need to stop.
- Inspect resource-based policies with IAM Access Analyzer. Use it to find resource policies that allow access from outside your intended zone and to evaluate how guardrails affect them.
- Review SCPs, IAM policies, and endpoint policies together. Check that a guardrail does not conflict with an identity or endpoint statement you depend on.
- Define service-principal and service-mediated exceptions. Add them explicitly, based on the intended patterns from step one.
- Confirm condition-key support for every restricted service. Do this before using
aws:VpceAccount,aws:VpceOrgPaths, oraws:VpceOrgIDat scale. - Monitor continuously. AWS Prescriptive Guidance names the AWS Config managed rule
SERVICE_VPC_ENDPOINT_ENABLEDin its monitoring recommendations. Confirm the rule’s current applicability and configuration in the AWS Config documentation before depending on it in your environment.
Criteria for comparing perimeter designs
When two perimeter designs are being compared, assess them on five axes:
Best Value
- Enforcement point: does the control sit on the principal, the resource, or the endpoint?
- Condition enforced: which identity, resource, or network condition does it check?
- Service and condition-key support: do all the services in scope support the keys the design uses?
- Legitimate service and partner exceptions: which service-principal and service-mediated paths must still work, and how are they scoped?
- Operational review and analysis: how are policies inspected, analyzed, and monitored over time?
What the published evidence does and does not show
AWS’s perimeter material is implementation guidance: it defines the model, the condition keys, and the policy responsibilities. It does not include a measured effectiveness figure for data perimeters, such as a breach-reduction rate or a performance benchmark, and none is offered here. Whether a particular deployment reduces risk depends on how completely the perimeter covers your identities, resources, and networks, and on how carefully its exceptions are scoped and reviewed.
The official material is also specific about what it does not claim. Treat the castle wall as one layer that is now checked alongside identity and resource context, and verify each condition key and service against the current AWS documentation before you put it into production.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
