IAM Is the Worst
matduggan.com
IAM Is the Worst
1–10 of 102 posts
Re: IAM Is the Worst
#2Please don't do what this article advises. These are 10 min of my life I will never get back...
IAM is not that complicated. The example diagram for AWS is showing all the features available. You can use only what you require.
Do two things from the beginning:
1) Least Privilege - Only the permissions required: You need to do that, because due to the constant zero days around the different software vendors, you are statistically guaranteed to have a security event. Establishing security boundaries will allow to contain the damage.
In combination with....
2) Temporary Privileges - Assume the roles with the permissions you require only when you required them: This will make it harder on an attacker, since they will need to compromise you while you are holding those elevated privileges. When you finish your task, either manually or programmatically, detach from the role or assume a different one with lower or different permissions.
Re: IAM Is the Worst
#3That hell wouldn't exist without the guys who like to endlessly and "dutifully" set up and rearrange security groups, IAM, ldap hierarchies, just in order to feel important I guess. Every company bigger than a dozen of employees has this type of guys and they are nightmare to work with; they vision is very often detached from the reality how the company works, but somehow they have the illusion that the policy existing mainly in their heads is more important than the real behaviours of people in the organization.
Re: IAM Is the Worst
#4Please don't do what this article advises. These are 10 min of my life I will never get back... IAM is not that complicated. The example diagram for AWS is showing all the features available. You can use only what you require. Do two things from the beginning: 1) Least Privilege - Only the permissions required: You need to do that, because due to the constant zero days around the different software vendors, you are s…
Isn't that exactly what this article is advocating for? Its just getting to Least Privilege in a much less painful way than is common.
Re: IAM Is the Worst
#5Please don't do what this article advises. These are 10 min of my life I will never get back... IAM is not that complicated. The example diagram for AWS is showing all the features available. You can use only what you require. Do two things from the beginning: 1) Least Privilege - Only the permissions required: You need to do that, because due to the constant zero days around the different software vendors, you are s…
Temporary Privileges is an example of security theater. It does not change the attack surface in a threat model because the model is not temporal. Has anyone ever shown a practical evidence that the attacker will face a problem waiting for the elevated permissions to support this idea?
And if you still really want to do that, you don't need AWS roles as a separate concept for this. You can just use temporary membership in groups.
AWS IAM model is overcomplicated compared to GCP/Azure. It becomes clear when you try to migrate the project with multiple envs (projects in GCP aka accounts in AWS) with cross-env accesses.
Re: IAM Is the Worst
#6Please don't do what this article advises. These are 10 min of my life I will never get back... IAM is not that complicated. The example diagram for AWS is showing all the features available. You can use only what you require. Do two things from the beginning: 1) Least Privilege - Only the permissions required: You need to do that, because due to the constant zero days around the different software vendors, you are s…
The article completely addresses the problems in #1 and you’ve offered no solutions. It offers a solution for determining what the hell the least priveleges are, while you assume prescient knowledge of them without justification. Your #2 is also exactly one of its recommendations.
Re: IAM Is the Worst
#7Please don't do what this article advises. These are 10 min of my life I will never get back... IAM is not that complicated. The example diagram for AWS is showing all the features available. You can use only what you require. Do two things from the beginning: 1) Least Privilege - Only the permissions required: You need to do that, because due to the constant zero days around the different software vendors, you are s…
Temporary Privileges is an example of security theater. It does not change the attack surface in a threat model because the model is not temporal. Has anyone ever shown a practical evidence that the attacker will face a problem waiting for the elevated permissions to support this idea? And if you still really want to do that, you don't need AWS roles as a separate concept for this. You can just use temporary membersh…
> Temporary Privileges is an example of a security theater. It does not change the attack surface in a threat model because it's not temporal. Has anyone ever shown a practical evidence to support this idea?
I agree. I think the benefit of this is quite low. If someone takes over your machine, things are lost anyways. If they take over your machine but for some reason cannot access your password manager (or so) or your 2fa to increase priviledges, you at least gain some time before the attack happens since the attacker has to wait - but it's not a major win.
The only case where this really helps is if the attacker gains only temporary access to you (maybe a temporary vulnerability in the browser) but can't "persist" it. In that case, you can reduce the blast radius.
Re: IAM Is the Worst
#8This is what you need Identity Governance for, such as Sailpoint.
Re: IAM Is the Worst
#9That hell wouldn't exist without the guys who like to endlessly and "dutifully" set up and rearrange security groups, IAM, ldap hierarchies, just in order to feel important I guess. Every company bigger than a dozen of employees has this type of guys and they are nightmare to work with; they vision is very often detached from the reality how the company works, but somehow they have the illusion that the policy existi…
These guys are often hired to implement regulation or certification requirements and the organization, if its goal is to comply, has to change its behavior and processes.
Not saying your point is not true, I met guys who did it just because too. But it's not always malice or incompetence on their part.
Re: IAM Is the Worst
#10I quite like the way JupyterHub deals with scopes¹ via roles²:
You create a role called "cleanup user servers", which requires a scope of "read:users" and "admin:server"³ (i.e. a role is bundle of scopes), and then define the services that role has, such as "garbage-collect".
You then generate a new service that names "garbage-collect", and associate an API key with it, and boom, that API key has the permissions to read user metrics, and administer the servers and is tied to a specific service.
Want to add another service to that role (e.g. "berate-users")? Just add it as a service in that role definition, and you can use the exact same API key.
1: https://jupyterhub.readthedocs.io/en/stable/rbac/scopes.html
2: https://jupyterhub.readthedocs.io/en/stable/rbac/roles.html
3: or you can just shoot for the moon with the "admin" scope which encompasses everything.