Semantic-based Automated Reasoning for AWS Access Policies using SMT

Abstract

Cloud computing provides on-demand access to IT resources via the Internet. Permissions for these resources are defined by expressive access control policies. This paper presents a formalization of the Amazon Web Services (AWS) policy language and a corresponding analysis tool, called ZELKOVA, for verifying policy properties. ZELKOVA encodes the semantics of policies into SMT, compares behaviors, and verifies properties. It provides users a sound mechanism to detect misconfigurations of their policies. ZELKOVA solves a PSPACE-complete problem and is invoked many millions of times daily.

Rule-based Word Equation Solving

“…Since our goal is to minimize the input WES to a form which is easy to handle by an SMT-Solver, the limit is still appropriate. We measured the time used by each solver 3 to reach a verdict, the verdict and the number of SMT-solver calls. If a solver times out we treat it as an "Unknown" verdict -although we will write it in the result tables as a timeout.…”

“…The reason is that we simplify formulas and eventually reach one that the SMT-solver can handle. The table sometimes indicates an 3 Here we refer to each instantiation of Woorpje as a different solver increase in solving time for an instance, whenever the count of SMT-solver calls goes up. In this cases the SMT-solver was usually not able to find a solution within the given timeout limits or simply was not able to draw any conclusion at all.…”

“…word equations arise naturally when performing symbolic execution of string heavy languages (e.g. JavaScript and Java) [11,27], and the need for verifying correctness of security policies [3]. To address these needs, a series of dedicated string solvers were developed [1,4,7,9,17,20,28].…”

Stratified Abstraction of Access Control Policies

“…In our context: how does the security analyst know whether the policy is, in fact not too strict or too permissive? Zelkova [2] is already used by users of Amazon's Simple Storage Service (S3) to determine whether any of their "data buckets" are publicly accessible. More generally, the AWS Config service provides templated Zelkova checks that can be filled in by users to validate their policies.…”

“…Second, the policy elements can interact with each other in subtle ways that make the net effect of a policy unclear. Previously, we developed Zelkova [2], a tool that encodes policies as logical formulas and then uses SMT solvers [3,8] to answer questions about policies, e.g. whether a particular policy is correct, too strict, or too permissive.…”