Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 79 posts

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#61

Post by verdverm »

justrealist wrote: post #49
verdverm wrote: post #2

Repost: https://news.ycombinator.com/item?id=34038663 (11 months ago) > We employ Large Language Models (currently OpenAI GPT-4) For IAM, this seems like a disaster waiting to happen. Combining hallucination problems with security settings is not a path I would consider

The space of "real" options in IAM is small enough that hallucination is not a real problem. Anecdotally I've used copilot to help write a lot of IAM polities in Terraform and the accuracy is basically 100% already.

human in the loop, during the prompt->gen phase, makes a huge difference. You can hit backspace and try different things

With an API that has a hidden / predefined prompt, you'll run into hallucinations that are harder or impossible to handle

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#62

Post by slalmeidabbm »

Boxxed wrote: post #25

Interesting use of GPT; it's cool that it works as well as it does but I'd be nervous about the various insidious ways it can fail. On another note, are there tools that will scan your AWS/GCP logs and emit configuration to limit permissions to what you're actually using? I could even see GPT doing better here too, or at least it would be easier to test.

We're currently focusing on a full shift-left approach to policy creation. Using AWS/GCP logs to create policies would work very well but it would need a few things to happen:

1. The service needs to be deployed 2. To produce an actual result, the calls that make use of the sdk need to be triggered

This is something that would be better included as an addition to monitor policy usage and adjust.

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#63

Post by blincoln »

verdverm wrote: post #36
kkapelon wrote: post #32

Earlier quoted context omitted.

> Such as? What is the material impact of a workflow or a user having too many permissions? Security obviously https://en.wikipedia.org/wiki/Principle_of_least_privilege

That is the "theoretical" problem How many times have excess permissions "actually" been the problem... versus something like correct permissions with compromised credentials?

It's hard to know with any kind of accuracy how often it comes up in real breaches, but we exploit it all the time to great effect in pen testing.

A few examples I've seen repeatedly:

* An AWS-hosted container/artifact/CI/CD application has an SSRF vulnerability that can be used to retrieve IAM instance credentials. Because micromanaging permissions is hard, and the application needs to access so much content in S3, spin up/down instances, etc. it has ec2:* and s3:. Unless the organization has created a separate AWS account for this platform specifically, it's probably game over at that point.

An internet-facing MDM solution has a code execution vulnerability. Because the vendor didn't want to document all of the individual permissions it needs, the installation instructions specify that it should run as an account with Domain Admin permissions in AD. That is definitely game over for most organizations, because even systems that don't authenticate against AD are almost always accessed from systems that do.

Micromanaging permissions is hard in a big organization. I saw it done well, years ago, in Active Directory, but it took several FTEs who were personally interested in the topic to set up and manage, and that was a traditional big business IT environment. In a startup-style free-for-all, good luck. I don't have an opinion either way on Slauth specifically, but something that generates IAM policies procedurally seems like a step in the right direction.

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#64

Post by vrosas »

callalex wrote: post #58

Can someone explain to me what is so difficult about writing security policies? Are people really deploying services in production without understanding the upstream and downstream dependencies of the service? Also at cloud-scale 95% accuracy is completely unacceptable.

> Are people really deploying services in production without understanding...

Oh you sweet summer child. But in reality I've seen the pattern over and over, especially in GCP. 1. Create service account 2. Give it Owner permission for the whole project 3. Download key and check it into source control 4. deploy.

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#65

Post by verdverm »

debarshri wrote: post #57
verdverm wrote: post #2

Repost: https://news.ycombinator.com/item?id=34038663 (11 months ago) > We employ Large Language Models (currently OpenAI GPT-4) For IAM, this seems like a disaster waiting to happen. Combining hallucination problems with security settings is not a path I would consider

It feels like taking one security problem and creating another problem.

Yeah, when it breaks, and the human didn't write it, it will be a lot harder to fix. It's like being responsible for the output of a junior programmer

My general approach is to spend more time up-front, so when you are in the heat of a problem, you don't have to learn under pressure. I think my beard is graying

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#66

Post by jedberg »

Why are you using (very expensive) GPT, or any LLM for that matter, when this was already a solved problem using rulesets? Netflix for example has open source that does this already: https://github.com/Netflix/consoleme

Instead of analyzing your code, you just run your code with no permissions and it automatically detects permission failures and thens open those permissions, with a UI showing you what it did so you can remove any permissions you don't want.

That actually seems much more secure than trying to divine the rules from reading the code.

What value is the LLM adding here?

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#67

Post by nextworddev »

jedberg wrote: post #66

Why are you using (very expensive) GPT, or any LLM for that matter, when this was already a solved problem using rulesets? Netflix for example has open source that does this already: https://github.com/Netflix/consoleme Instead of analyzing your code, you just run your code with no permissions and it automatically detects permission failures and thens open those permissions, with a UI showing you what it did so you c…

So it can call itself an AI startup?

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#68

Post by codegeek »

jedberg wrote: post #66

Why are you using (very expensive) GPT, or any LLM for that matter, when this was already a solved problem using rulesets? Netflix for example has open source that does this already: https://github.com/Netflix/consoleme Instead of analyzing your code, you just run your code with no permissions and it automatically detects permission failures and thens open those permissions, with a UI showing you what it did so you c…

Not to knock on the OP but in general, if you are doing a startup in 2023, you cannot do it without AI otherwise no one will take your seriously. I am not joking. AI is the new Gold Rush that blockchain used to be. Personally, I do think that AI is awesome and has lot of great use cases but unfortunately, most VCs/Investors are looking for that keyword if you wanna get funded so I feel a lot of startups are forcing AI into their stuff.

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#70

Post by jedberg »

codegeek wrote: post #68
jedberg wrote: post #66

Why are you using (very expensive) GPT, or any LLM for that matter, when this was already a solved problem using rulesets? Netflix for example has open source that does this already: https://github.com/Netflix/consoleme Instead of analyzing your code, you just run your code with no permissions and it automatically detects permission failures and thens open those permissions, with a UI showing you what it did so you c…

Not to knock on the OP but in general, if you are doing a startup in 2023, you cannot do it without AI otherwise no one will take your seriously. I am not joking. AI is the new Gold Rush that blockchain used to be. Personally, I do think that AI is awesome and has lot of great use cases but unfortunately, most VCs/Investors are looking for that keyword if you wanna get funded so I feel a lot of startups are forcing A…

Yeah I'm seeing that. As an investor myself, the first question I always ask is "what unique data do you bring to the table that other people can't get?". My next question is always "What value does an LLM add beyond what we could already do with traditional (and much cheaper) models or just rulesets?"

I'd like to think most investors are sophisticated enough to detect when the "AI" was just bolted on for funding, and that most startups aren't actually doing that, but are using LLM for a reason.

Post reply on HN