The Ins and Outs of Building an AWS Data Perimeter

Data perimeter concept

Stripe cloud security engineer John Bridges introduces an AWS data perimeter: organization-wide guardrails that deny cross-boundary access by default and require high approval to trust external principals, vendors, or exfiltrated credentials. The goal is a zone of distrust outside the org when incidents involve data crossing organizational edges.

Six control types

The perimeter addresses six cross-organizational access patterns. Bridges ranks risk: same-account requests are safest, intra-org cross-account moderate, and leaving the AWS organization most dangerous—yet IAM policy evaluation only distinguishes in-account versus cross-account, not org membership.

Credential exfiltration SCP

A service control policy can bind EC2 instance role credentials to trusted VPC endpoints or IP ranges using aws:SourceVpc, aws:SourceIp, and principal ARN conditions, while allowing AWS service use. Real deployments need exceptions for peered VPCs, pre-signed S3 URLs, and permission-only actions like RDS IAM authentication.

Implementation reality

Combining base deny logic with exceptions produces complex SCPs. The talk covers theory, building blocks, and rollout without breaking production—acknowledging the topic exceeds a short session.