Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 79 posts

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#41

Post by SOLAR_FIELDS »

bradleyy wrote: post #21

I love the idea of this. The big disconnect here is I can't share code with OpenAI for various reasons. Would you consider using something like AWS Bedrock+Anthropic Claude, where we have better (more predictable/risk profile) control over data-sharing, etc?

I’ve thought for a long while that using OpenAI on things that touch internal infra/data components is closing off a huge potential market. I’ve had a few people on the cutting edge of AI tell me that the risk profile is acceptable for a lot of companies, but I’m extremely skeptical that’s the case based on my own experience building cloud and data infra SaaS. Corps want self hosted solutions for their most critical components. I might be proven wrong, but the people who are telling me I’m wrong often have a vested interest in that not being true (building some SaaS product where the only way hockey stick growth the VC’s want can be achieved is by putting the eggs in the cloud basket)

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#42

Post by kkapelon »

lijok wrote: post #37
kkapelon wrote: post #32

Earlier quoted context omitted.

> Such as? What is the material impact of a workflow or a user having too many permissions? Security obviously https://en.wikipedia.org/wiki/Principle_of_least_privilege

If you're trying to sell a tool, you don't justify its cost by saying it addresses "huge problems" such as "security". Lets talk material impact; how will this tool pay for itself?

Sorry, I am not trying to sell anything. I am not OP or parent poster.

If you want to hear about stories of privilege escalation there should be easy to find. I also have some on my own which I might describe in another post but essentially it was the classic - CI/CD pipeline that "thinks" it has access only to QA does a "destroy all servers" in both QA and Production because it also had access to production without knowing anything about it.

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#44

Post by kkapelon »

verdverm wrote: post #36
kkapelon wrote: post #32

Earlier quoted context omitted.

> Such as? What is the material impact of a workflow or a user having too many permissions? Security obviously https://en.wikipedia.org/wiki/Principle_of_least_privilege

That is the "theoretical" problem How many times have excess permissions "actually" been the problem... versus something like correct permissions with compromised credentials?

I am not a security expert by any means, but there are several stories of excess permissions that resulted in the security breaches. The last one I actually remember was here in HN, and I think it was about a bug bounty for Facebook where a QA system could affect production. The bug bounty person "broke" production by "breaking" in the QA system.

By the way, I have no affiliation with slauth.io (just found them today as well). I just think that https://en.wikipedia.org/wiki/Principle_of_least_privilege is something good to follow in critical systems.

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#45

Post by verdverm »

kkapelon wrote: post #42
lijok wrote: post #37

Earlier quoted context omitted.

If you're trying to sell a tool, you don't justify its cost by saying it addresses "huge problems" such as "security". Lets talk material impact; how will this tool pay for itself?

Sorry, I am not trying to sell anything. I am not OP or parent poster. If you want to hear about stories of privilege escalation there should be easy to find. I also have some on my own which I might describe in another post but essentially it was the classic - CI/CD pipeline that "thinks" it has access only to QA does a "destroy all servers" in both QA and Production because it also had access to production without…

Famous HN (reddit) post: https://news.ycombinator.com/item?id=14476421

"Accidentally destroyed production database on first day of a job"

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#46

Post by kkapelon »

verdverm wrote: post #45
kkapelon wrote: post #42

Earlier quoted context omitted.

Sorry, I am not trying to sell anything. I am not OP or parent poster. If you want to hear about stories of privilege escalation there should be easy to find. I also have some on my own which I might describe in another post but essentially it was the classic - CI/CD pipeline that "thinks" it has access only to QA does a "destroy all servers" in both QA and Production because it also had access to production without…

Famous HN (reddit) post: https://news.ycombinator.com/item?id=14476421 "Accidentally destroyed production database on first day of a job"

I also like the "integration tests reaching production" as well https://news.ycombinator.com/item?id=27546017

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#47

Post by sbarre »

biccboii wrote: post #27

If I were going to use ChatGPT to generate my IAM policies, why do I need a middleman to do that?

It sounds like the value they bring is the custom prompts they've written?

And probably some quality-of-life wrappers around all that process?

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#48

Post by sbarre »

bradleyy wrote: post #21

I love the idea of this. The big disconnect here is I can't share code with OpenAI for various reasons. Would you consider using something like AWS Bedrock+Anthropic Claude, where we have better (more predictable/risk profile) control over data-sharing, etc?

Yeah we're in the same boat, I was somewhat excited about this at first read and then I got to "LLMs" and "OpenAI" and I just stopped reading. :-(

But I'm sure others are ok with it, so that's great.

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#49

Post by justrealist »

verdverm wrote: post #2

Repost: https://news.ycombinator.com/item?id=34038663 (11 months ago) > We employ Large Language Models (currently OpenAI GPT-4) For IAM, this seems like a disaster waiting to happen. Combining hallucination problems with security settings is not a path I would consider

The space of "real" options in IAM is small enough that hallucination is not a real problem.

Anecdotally I've used copilot to help write a lot of IAM polities in Terraform and the accuracy is basically 100% already.

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#50

Post by debussyman »

I like this approach, I've always thought that IaC could be generated by scanning application code. Although I share the skepticism that IAM is the best place to start.

I'm curious though how well an LLM performs for newly released AWS services? This is where I've experienced the most arcane IAM definitions personally, but I wonder if GPT 4 is trained well enough on newer sources.

Post reply on HN