Slightly off-topic: The Mindmap looks pretty cool. Does somebody know which technology he used for that?
I think the author used OmniGraffle [0]. If not, then the tool used is surprisingly similar.
AWS Security Primer
11–20 of 43 posts
Re: AWS Security Primer
#12Slightly off-topic: The Mindmap looks pretty cool. Does somebody know which technology he used for that?
I used SimpleMind https://simplemind.eu/download/free-edition/
Re: AWS Security Primer
#13Re: AWS Security Primer
#14I've always found AWS's security system pretty confusing, so I'm a big fan of this primer. There's such a huge number of stuff that it can difficult to even begin to know what to look for. From my limited experience, Google Cloud Platform seems to be much easier to setup.
What I'd really love to see an end-to-end example of a non-trivial production-ready project, with all its nitty-gritty details. I'd expect that having a sensible baseline you could look to for general guidance would help improve security and reduce risk.
Re: AWS Security Primer
#15I found trying to manage and reason about AWS access control super confusing (especially across accounts), so I built a lightweight tool to dump and load IAM config to yaml files. https://github.com/99designs/iamy
It has recently started becoming popular quite organically, so I might just write a blog post on it soon.
Re: AWS Security Primer
#16I find AWS security "primers" are usually quite brief - and necessarily so, because otherwise they wouldn't be a "primer". But that brevity leads to a common set of rules which, in the absence of a full explanation, lose something.
For example, just every AWS environment I look at, someone knew that should create an IAM account, and never use the root account. Which is why there is a root account that's never used, and one IAM account with "Administrator" permission that everyone shares.
If you ever propose we review it, someone will point me at an AWS security guide and say "it's fine, we're not using the root".
Re: AWS Security Primer
#17I found trying to manage and reason about AWS access control super confusing (especially across accounts), so I built a lightweight tool to dump and load IAM config to yaml files. https://github.com/99designs/iamy It has recently started becoming popular quite organically, so I might just write a blog post on it soon.
are there any advantages over CloudFormation?
Re: AWS Security Primer
#18I found trying to manage and reason about AWS access control super confusing (especially across accounts), so I built a lightweight tool to dump and load IAM config to yaml files. https://github.com/99designs/iamy It has recently started becoming popular quite organically, so I might just write a blog post on it soon.
are there any advantages over CloudFormation?
I'd say the biggest advantage is that it slots in easily to an existing environment that is not necessarily managed strictly.
I've found depending on how strict your change management policies are, IAM creds can collect cruft over time as people push new policies in ad-hoc. So iamy is handy for such a situation
- iamy can sync in both directions - pull and push IAM config. So you can easily pull down the ad-hoc changes
- In order to use CFN you need to have access, so there is a chicken-egg scenario if you want to manage ALL users in config
- iamy gives you a nice execution plan of aws cli commands, CFN can be opaque
And iamy does ignore any resource managed by CFN, so it works well as complimentary tool.
Re: AWS Security Primer
#19I found trying to manage and reason about AWS access control super confusing (especially across accounts), so I built a lightweight tool to dump and load IAM config to yaml files. https://github.com/99designs/iamy It has recently started becoming popular quite organically, so I might just write a blog post on it soon.
are there any advantages over CloudFormation?
Oh and by the way it was actually your https://cloudonaut.io/your-single-aws-account-is-a-serious-r... post that indirectly inspired this tool, so thanks!
We consolidated users into a bastion account, ran into annoyances with CFN, and have been using iamy ever since for change management across all our accounts (more of a writeup at https://99designs.com.au/tech-blog/blog/2015/10/26/aws-vault...)
Re: AWS Security Primer
#20AWS is so f-ing confusing sometimes.
Any aspect in particular? I'm always happy to pass feedback along to the teams.