Website down…?
Getting slower haha... HN is generating traffic but will have to ask Webflow what's going on lol
Launch HN: Slauth.io (YC S22) – IAM Policy Auto-Generation
11–20 of 33 posts
Re: Launch HN: Slauth.io (YC S22) – IAM Policy Auto-Generation
#12Also a tool that will detect when more permissions are needed will be appreciated. For now it's running `tf apply`, getting 403, searching and reading CloudTrail, changing one permission, goto 1
Re: Launch HN: Slauth.io (YC S22) – IAM Policy Auto-Generation
#13Could you expand on how this compares to IAM's built-in Access Analyzer[0]?
[0]: https://docs.aws.amazon.com/IAM/latest/UserGuide/access-anal...
Re: Launch HN: Slauth.io (YC S22) – IAM Policy Auto-Generation
#14See also: https://github.com/puresec/serverless-puresec-cli
Thanks! Will have a look. Have you used it? If so, would love to learn what you liked and didn't like
Re: Launch HN: Slauth.io (YC S22) – IAM Policy Auto-Generation
#15Could you expand on how this compares to IAM's built-in Access Analyzer[0]? [0]: https://docs.aws.amazon.com/IAM/latest/UserGuide/access-anal...
We have found several "problems" that we think can be done better
1) CloudTrail requires to run for a duration of time before suggesting a policy which means long time until getting value. What do you do until the suggestion? Run a less secure policy?
2) CloudTrial actually doesn't log all events so we are using either AWS SDK metrics or a proxy to make sure we get all activity
3) Integrations with Terraform, Git repository in order to make it easy to use in day to day
4) Hopefully in the future we can extend to other cloud vendors :)
Re: Launch HN: Slauth.io (YC S22) – IAM Policy Auto-Generation
#16Could you expand on how this compares to IAM's built-in Access Analyzer[0]? [0]: https://docs.aws.amazon.com/IAM/latest/UserGuide/access-anal...
To add some more pros, Access Analyzer has limits on the amount of policies you can generate at a certain time and doesn't support all AWS services
Re: Launch HN: Slauth.io (YC S22) – IAM Policy Auto-Generation
#17How would you compare your offering to https://github.com/iann0036/iamlive (an opensource implementation of IAM generation from client-side monitoring or proxy, released in Feb 2021)?
Re: Launch HN: Slauth.io (YC S22) – IAM Policy Auto-Generation
#18How would you compare your offering to https://github.com/iann0036/iamlive (an opensource implementation of IAM generation from client-side monitoring or proxy, released in Feb 2021)?
We definitely love iamlive! Iamlive is easy to operate manually on a single instance, and outputs the results to the terminal, making it great for local exploration. We focus on observing IAM at scale, collecting data from multiple sources - local / staging / per-developer environments etc. We know to find the relevant IaC code piece and generate policies in the form of Git Pull Requests.
Re: Launch HN: Slauth.io (YC S22) – IAM Policy Auto-Generation
#19> 3 IAM policies per month
This is... Not a useful number of policies. I've got a terraform setup for my one person business and I probably have two orders of magnitude more policies than this.
Who is this targeted at? Which policies am I supposed to use these three on? What kind of service only has three policies? How am I supposed to evaluate your service with this small number of policies? The problem is that they might be the "perfect" global maximum goodness policies, but they exist in a web of policies that all need to be correct together. So three does nothing to show me how good your service is, and it's not useful (afaict) for ongoing work.
Here's how I can see you fixing this:
- Just charge me. Give me a trial. Let me pay up front and have a money back policy. Let me generate what I need and see whether it's useful.
- Give me unlimited free policies, but charge for things like tightening down resource access (e.g., narrowing access to specific S3 buckets instead of just narrowing access to S3).