5.2.2. ABAC and RBAC Strategies

First Principle: RBAC assigns permissions based on job function (roles), while ABAC assigns permissions based on attributes (tags). ABAC scales better in dynamic environments because new resources automatically inherit access based on matching tags, without policy updates.

RBAC (Role-Based Access Control):

• Create roles for job functions: SecurityAuditor, DevOps, DataAnalyst
• Each role has a fixed set of permissions
• Adding a new project requires updating policies (add new resource ARNs)
• Best for: stable environments with well-defined roles and few resource changes

ABAC (Attribute-Based Access Control):

• Policies use tag conditions: aws:ResourceTag/Project equals aws:PrincipalTag/Project
• New resources with correct tags are automatically accessible — no policy updates
• One policy handles all projects through tag matching
• Best for: dynamic environments with frequent resource creation and team changes

ABAC Example Policy Logic:

Allow action on resource WHERE
  resource tag "Project" = principal tag "Project"
  AND resource tag "Environment" = "production"
  AND principal tag "ClearanceLevel" >= "confidential"

Combining RBAC and ABAC:

Most real-world environments use both: RBAC for coarse access (role determines service access) and ABAC for fine-grained access (tags determine resource access within services).

Tag Security for ABAC:

• ABAC is only as secure as your tag governance
• Implement SCPs or IAM policies that restrict who can create/modify tags
• Use AWS Organizations tag policies to enforce consistent tag values
• Audit tag changes through CloudTrail

⚠️ Exam Trap: ABAC's strength (automatic access via tags) is also its risk: if anyone can modify tags, they can grant themselves access. Always pair ABAC with tag mutation controls.

Scenario: A company with 50 development teams creates resources daily. With RBAC, each new project requires an admin to update IAM policies. With ABAC, they tag new resources with Project: [team-name] and the existing policy automatically grants access to the matching team — zero admin overhead.

Reflection Question: Why does ABAC scale better than RBAC for organizations with hundreds of projects, and what governance controls does ABAC require?