MTB DP DEV — IAM Access Model Diagram

IAM Groups (7)

• Administrators — AdministratorAccess (senior DevOps only)
• DevOps — PowerUserAccess + IAMReadOnly + Terraform custom
• Developers — EC2Full + S3Full + RDSFull + EKS custom
• Developers: Deny ec2:Terminate, rds:Delete, s3:DeleteBucket
• ReadOnly — ReadOnlyAccess (analysts, managers)
• SecurityAuditors — SecurityAudit + ReadOnly
• Billing — Billing + BillingReadOnly (finance)
• read-write-bucket — S3 RW on dev-bin-range-files

IAM Users (14 human + 2 SA)

• DevOps: dmoskalenko — groups: DevOps, ReadOnly
• Manager: mrakov — groups: ReadOnly + MFA policy
• Developer: ahromov — groups: Developers, ReadOnly, S3-RW
• Developer: eprystash — groups: Developers, ReadOnly, S3-RW
• Developer: asharando — groups: Developers, ReadOnly, S3-RW
• Developer: ikosenkov, ypopenkov, kshuba, opiven, rhushpit
• Developer: ykhorolska, mpetrov (+MFA), azhyvotovskyi (+MFA)
• Developer: msurzhyk (+MFA) — all: Developers, ReadOnly, S3-RW
• SA: sa-env-dev — PowerUser + IAM mgmt + TF state RW + ECR read
• SA: sa-pipe-dev — EKS + ECR full + TF state RO

EKS Access Entries (16)

• Admin (AmazonEKSClusterAdminPolicy):
• sa-env-dev, sa-pipe-dev
• Edit (AmazonEKSEditPolicy) — 14 users:
• ahromov, eprystash, asharando, ikosenkov
• ypopenkov, kshuba, opiven, rhushpit
• ykhorolska, mpetrov, azhyvotovskyi, msurzhyk
• nhaitanov, osebalo
• Note: nhaitanov, osebalo have EKS access but no IAM user in TF

IRSA Roles (8 pod-level bindings)

• cert-manager-route53 (ns: cert-manager) → Route53 DNS-01
• dev-s3-access (ns: dev, sa: payment-service) → S3 bin-range
• binrange-s3-access (ns: dev, sa: binrange-payment-svc) → S3
• cluster-autoscaler (ns: kube-system) → ASG scale
• node-health-monitor (ns: kube-system) → ASG SetInstanceHealth
• ebs-csi-driver (ns: kube-system) → EBS CSI policy
• fluent-bit-cloudwatch (ns: infra-services) → CloudWatch logs
• ecr-cross-account (ns: default, sa: ecr-pull) → ECR 957849...

Security Controls

• Password policy: min 20 chars, MFA enforcement module
• MFA policy attached to: mpetrov, azhyvotovskyi, msurzhyk, mrakov
• Developers group: Deny destructive ops (Terminate, DeleteDB, DeleteBucket)
• Service accounts: /service-accounts/ path, no console access
• Human users: /users/ path, console + programmatic access
• Password reset required on first login for all users