Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IAM is hard – Thoughts on $80M fine from the Capital One Breach

twitter.com

Post reply on HN
Print view View original

71–80 of 125 posts

Re: IAM is hard – Thoughts on $80M fine from the Capital One Breach

#71

Post by staticassertion »

mesofile wrote: post #8

My general experience with crafting IAM policies is very reminiscent of SELinux, in that it's very difficult to work agnostically while adhering to a principle of least privilege. Especially given that this kind of task is often done by admin/ops people, one typically can't know in advance everything that the app might need to be able to access in order to work correctly. The process of discovering this is: try runni…

That describes my own personal hell with iam, and it drove me to adopt aws-cdk.

aws-cdk is their infra-as-code product and it's extremely valuable for iam alone.

You can say things like: my_lambda.grantRead(s3_bucket)

And it figures out the least privileges necessary to make all of that work.

Plus it's real code, not some annoying DSL, which means you can easily abstract other iam permissions out. I have a fairly tight lambda policy that I reuse in all sorts of places, and it's as easy to use as the above snippet.

Re: IAM is hard – Thoughts on $80M fine from the Capital One Breach

#72

Post by jariel »

Aside from the inherent complexity of complex systems, there's another layer we don't talk about and that is arbitrary complexity, particularly in communications, standards and documentation.

A lot of IAM does not need need to be that hard but concepts need to be poignantly clear. It's harder than it needs to be.

Re: IAM is hard – Thoughts on $80M fine from the Capital One Breach

#73

Post by ublaze »

jedberg wrote: post #70

FYI for anyone in the same situation, Netflix built some open source packages to solve this: https://netflixtechblog.com/introducing-aardvark-and-repokid... The idea is that the default policy on new things is deny all, and then it monitors cloudtrail for privilege failures and reconfigures IAM to allow the smallest possible privilege to get rid of that deny message.

Offering this service can probably be spun into its own SAAS company.

Re: IAM is hard – Thoughts on $80M fine from the Capital One Breach

#75

Post by orf »

staticassertion wrote: post #71
mesofile wrote: post #8

My general experience with crafting IAM policies is very reminiscent of SELinux, in that it's very difficult to work agnostically while adhering to a principle of least privilege. Especially given that this kind of task is often done by admin/ops people, one typically can't know in advance everything that the app might need to be able to access in order to work correctly. The process of discovering this is: try runni…

That describes my own personal hell with iam, and it drove me to adopt aws-cdk. aws-cdk is their infra-as-code product and it's extremely valuable for iam alone. You can say things like: my_lambda.grantRead(s3_bucket) And it figures out the least privileges necessary to make all of that work. Plus it's real code, not some annoying DSL, which means you can easily abstract other iam permissions out. I have a fairly tig…

Cloudformation. Ewww.

Re: IAM is hard – Thoughts on $80M fine from the Capital One Breach

#76

Post by AnHonestComment »

devonkim wrote: post #31
freedomben wrote: post #12

Earlier quoted context omitted.

I've seen this a ton. I have been an on/off security professional so academically I am committed to the principle of least privilege, but holy hell it can be painful or impossible in real life. Where possible I've started adopting the "run it and see" or audit2allow approach (there are awesome tools that can do this for AWS IAM perms too), but then before applying the policy, somebody needs to put a quick line beside…

Years ago I wrote a program to let various services run their course, query Cloudtrail for successful calls madero different AWS services, and attempt to find a minimal set of IAM permissions (not applicable for S3 at the time). The idea was to run an exhaustive test suite with expected allowed actions only and deny anything else. I believe AWS has a similar tool now for IAM but it’s not a problem that’ll be resolved…

AWS actually has a research team applying formal methods to IAM because doing it by hand is impossible.

https://aws.amazon.com/iam/features/analyze-access/

Re: IAM is hard – Thoughts on $80M fine from the Capital One Breach

#77

Post by vdm »

bilater wrote: post #48

Noob question but doesn't having a private VPC at least limit external users from accessing anything since they have to be part of the network?

A bucket policy can restrict access to only Access Points, which can in turn be restricted to VPC endpoints.

Re: IAM is hard – Thoughts on $80M fine from the Capital One Breach

#78

Post by gray_-_wolf »

mesofile wrote: post #8

My general experience with crafting IAM policies is very reminiscent of SELinux, in that it's very difficult to work agnostically while adhering to a principle of least privilege. Especially given that this kind of task is often done by admin/ops people, one typically can't know in advance everything that the app might need to be able to access in order to work correctly. The process of discovering this is: try runni…

In our company we went the other road. We have the developers write the policies (since I mean, they know what their app needs) and test it in dev environments. After that, ops guys step in during code review to check for too broad allow in the policies. So far it seems to work in acceptable manner.

Re: IAM is hard – Thoughts on $80M fine from the Capital One Breach

#79

Post by scoot »

jedberg wrote: post #70

FYI for anyone in the same situation, Netflix built some open source packages to solve this: https://netflixtechblog.com/introducing-aardvark-and-repokid... The idea is that the default policy on new things is deny all, and then it monitors cloudtrail for privilege failures and reconfigures IAM to allow the smallest possible privilege to get rid of that deny message.

So it gives a services any privilege it asks for? I haven't read the article, but from your description it doesn't sound much better than default allow-all.

Re: IAM is hard – Thoughts on $80M fine from the Capital One Breach

#80

Post by danaur »

scoot wrote: post #79
jedberg wrote: post #70

FYI for anyone in the same situation, Netflix built some open source packages to solve this: https://netflixtechblog.com/introducing-aardvark-and-repokid... The idea is that the default policy on new things is deny all, and then it monitors cloudtrail for privilege failures and reconfigures IAM to allow the smallest possible privilege to get rid of that deny message.

So it gives a services any privilege it asks for? I haven't read the article, but from your description it doesn't sound much better than default allow-all.

It sounds a lot better. Set up your script and run it and the tool determines the minimum set of permissions needed for future runs. You lock that permission set in for future runs. Read the link
Post reply on HN