In practice, I've see access controls typically as being too loose creating risk in areas such as admin access or with wild cards as in the Capital One breach. The alternative is often too tight in which case developers struggle with ops to manage the things they need access to. Just in time access controls (and change logs) and isolating resources through the concept of a project or tenant is one approach, and, if you will pardon the plug, the approach we’ve chosen with our no code, infrastructure as code platform www.duplocloud.com.
IAM is hard – Thoughts on $80M fine from the Capital One Breach
121–125 of 125 posts
Re: IAM is hard – Thoughts on $80M fine from the Capital One Breach
#122Earlier quoted context omitted.
In my company, developers write policies, but they have to be approved by someone with ops expertise (usually me). And the policies are often either too broad, or not sufficiently tested, and missing permissions for things it needed. Sometimes the same policy has both problems. I don't blame the developers. You can hardly expect every developer to become an expert on AWS's IAM system. Especially given how inconsisten…
>or not sufficiently tested How do you test a policy?
You set up a policy in a test environment and run the code there. Of course, generally, the policy can't be identical across environments, so you can run into errors.
Re: IAM is hard – Thoughts on $80M fine from the Capital One Breach
#123Earlier quoted context omitted.
>> we've decided that having infra teams manage hundreds or thousands of lines of not-very-human-readable JSON across all the IAM resources they manage is the proper way to do things. This is exactly why with few of my friends started to work on a tool that uses a typed language to express IaC. We can leverage and or relations for AWS objects. One quick example. S3 resource is PublicWebsite or ForwardOnly or PrivateB…
Sounds really interesting, is there a public repo up yet to take a look at?
Could you reach out on Keybase or email?
Re: IAM is hard – Thoughts on $80M fine from the Capital One Breach
#124Re: IAM is hard – Thoughts on $80M fine from the Capital One Breach
#125Earlier quoted context omitted.
I wonder about the complexity and AWS motivations. What does AWS gain by improving IAM? There are barely any competitors, so they won't be losing people for that. They offer their own AWS professional services happy to charge you for making it "understandable". Their service agreements largely absolve them of client mistakes. Which usually result in larger bills from AWS.
That's pretty cynical. AWS is a ball of complexity because it grew organically that way, and they don't have a culture of explaining, or, keeping things simple. Both of those things would require strong strategic guidance, and a real effort to do. Unless Bezos edicts: "Our APIs must remain simple even as they scale, and we must document in a manner that keeps the 80% common path easy to use, while the remaining 20% a…
No cynacism meant. My mistake. "motivations" was incorrect. I was trying to ask about how the business of AWS manifests such a thing. Which I think you've described. Thanks!