# Exercise 3: Design ABAC and Guardrails for a Growing Organization

`PetPal` grew from 3 to 12 product teams. Today each team has hand-written IAM policies per resource; adding a team takes a week of policy edits, and two incidents happened: (a) a developer gave a Lambda the `AdministratorAccess`-based role "to make it work", (b) a contractor's laptop with long-lived access keys was stolen.

## Deliverables

1. **ABAC model**: which tags (`team`, `env`, `data-classification`) go on principals (Identity Center attributes / role tags) and resources; write the policy that lets team members manage only their team's Lambda functions, SQS queues and secrets in non-prod.
2. **Tag protection**: policies that prevent users from changing the controlling tags on themselves or on resources.
3. **Safe delegation**: a permissions boundary for roles created by developers (allow app-level services, deny IAM/Organizations/billing/KMS key admin), and the policy that forces its use on role creation.
4. **Guardrail SCPs** (prose or JSON): deny IAM user access key creation, deny leaving the organization, deny disabling CloudTrail/GuardDuty/Config, restrict regions, require IMDSv2 on EC2 launches.
5. **Incident response**: steps for the stolen laptop with access keys (containment, investigation with CloudTrail, eradication), and the structural fix so it can't happen again.
6. **Rollout plan**: how to migrate 12 teams to ABAC without breaking production access.

## Requirements Checklist

- [ ] ABAC policy uses `aws:ResourceTag/team` = `${aws:PrincipalTag/team}` (and `aws:RequestTag/team` on create) plus an `env` condition.
- [ ] Tag protection denies `TagResource`/`UntagResource`/`iam:TagRole` for controlling keys unless admin, using `aws:TagKeys`.
- [ ] Boundary + `iam:PermissionsBoundary` condition on `iam:CreateRole`; boundary excludes IAM/Organizations/billing.
- [ ] SCPs: deny `iam:CreateAccessKey`/`iam:CreateUser` (except break-glass), `organizations:LeaveOrganization`, `cloudtrail:StopLogging`/`DeleteTrail`, `guardduty:DeleteDetector`, region restriction, `ec2:RunInstances` unless `ec2:MetadataHttpTokens = required`.
- [ ] Stolen keys: deactivate/delete keys immediately, revoke sessions, review CloudTrail for the key's activity, rotate anything it could read; structural fix = Identity Center with short-lived credentials, no IAM users.
- [ ] Rollout: tag resources first (audit), introduce ABAC policies alongside existing ones, monitor AccessDenied, then remove legacy policies team by team.