Projective Model Counting for IP Addresses in Access Control Policies

Zelkova is an AWS service that answers questions about Identity and Access Management (IAM) access policies such as “Does this policy allow public access?”. Zelkova formalizes IAM policies and the meaning of “public” as a logical query that can be solved using SMT solvers. Among other conditions, Zelkova defines a policy as public if it allows access from a number of IP addresses that exceeds a given threshold. Encoding this check so that it is supported by all SMT solvers in the Zelkova portfolio is difficult because counting and restricting the number of models are not core SMT features. We describe two SMT encodings for checking whether the number of IPs allowed by a policy exceeds a given bound. Both encodings generate an SMT formula that can be discharged with a single call to an off-the-shelf SMT solver. Our approach takes less than 3s to detect whether a policy is public for 99.999% of the evaluated policies.