This, among other reasons, is why our shop does the bare minimum in the cloud.
IAM Is the Worst
21–30 of 102 posts
Re: IAM Is the Worst
#22What’s nice about having 30 years of experience is that I don’t need anyone else’s confirmation when I realize something is poorly designed. If I can build firewalls in OpenBSD or Cisco IOS in text mode, SELinux, etc and IAM is coming off as byzantine, it’s because it is.
Not that I blame Amazon. I think they’re a victim of their own success in this regard and it was a solution that was devised ad hoc reactively as they ran into authorization problems rather than something that was architected top down. When you do that you always end up with a mess, but they may not have had a choice.
Re: IAM Is the Worst
#23My authorization boundaries are almost entirely in Userify within projects and server groups.
I only associate other permissions through AWS instance roles, because I try to not give out specific IAM roles or keys to users or developers AT ALL -- only to the instances they're logging into.
Obviously this probably can't work for all companies and is dependent on how you have your environments set up, but we even run development on EC2 instances, and with Userify we get a color coded view for who can log into which instances, and then those instances already have the correct custom role.
And there, no IAM to individuals at all.
Re: IAM Is the Worst
#24I’m glad someone wrote about it. IAM is hella confusing to me. Roles role impersonation and discovering what roles my user needs to use some service. It’s terrible. At least on the GCP clicking through the menus the wizards and front end is so nice that it makes enabling things and getting IAM right easier.
Re: IAM Is the Worst
#25IAM is fine, you're just not seeing it for what it is - a low-level tool upon which an abstraction must be placed, rather than used directly.
If your devs are thinking about IAM roles/permissions/whatever, your security dept failed.
Re: IAM Is the Worst
#26This is what you need Identity Governance for, such as Sailpoint.
How is it different?
Re: IAM Is the Worst
#27Please don't do what this article advises. These are 10 min of my life I will never get back... IAM is not that complicated. The example diagram for AWS is showing all the features available. You can use only what you require. Do two things from the beginning: 1) Least Privilege - Only the permissions required: You need to do that, because due to the constant zero days around the different software vendors, you are s…
Temporary Privileges is an example of security theater. It does not change the attack surface in a threat model because the model is not temporal. Has anyone ever shown a practical evidence that the attacker will face a problem waiting for the elevated permissions to support this idea? And if you still really want to do that, you don't need AWS roles as a separate concept for this. You can just use temporary membersh…
It's not just theater, it can be the difference between someone finding an unlocked laptop that needs to refresh their access before doing more actions or just having 100% unfettered access. This is only one attack vector that gets safer by temporary tokens with short expiries, and for the dev under normal work conditions just means every few hours (or whatever TTL) you need to place your finger on your fingerprint reader for 1 second.
Re: IAM Is the Worst
#28Please don't do what this article advises. These are 10 min of my life I will never get back... IAM is not that complicated. The example diagram for AWS is showing all the features available. You can use only what you require. Do two things from the beginning: 1) Least Privilege - Only the permissions required: You need to do that, because due to the constant zero days around the different software vendors, you are s…
GCP has a glaring problem with temporary privileges. The console doesn’t support them. So if there is some operational activity that a user needs to do via gui rarely you either have to manually give and take those permissions or let them sit with elevated permissions all the time.
And the lack of roles of roles is beyond idiotic, it’s downright dangerous.
Re: IAM Is the Worst
#29IAM is hideous; users, organisations and policies are a barouque mess, where you're expected to hand-edit JSON files specifying resources then debug the cryptic error messages thrown when their own examples are pasted in. Plus the documentation is out of date in so many places, describing actions to take that have long since changed. It's ok for single users (simple single-user use cases) and large organisations that…
You have a visual editor to create those policies since 2017 at least - https://aws.amazon.com/blogs/security/use-the-new-visual-edi...
Unfortunately it only gets you so far before it's back to json land.
Re: IAM Is the Worst
#30Earlier quoted context omitted.
> Temporary Privileges is an example of a security theater. It does not change the attack surface in a threat model because it's not temporal. Has anyone ever shown a practical evidence to support this idea? I agree. I think the benefit of this is quite low. If someone takes over your machine, things are lost anyways. If they take over your machine but for some reason cannot access your password manager (or so) or yo…
Are you aware that you can associate an EC2 instance profile on a temporary basis with a role? And attach and detach them via api or on a schedule? Because if you do that, and you hack the machine (Linux, Windows or Mac not relevant...), but you don't have the role with the privileges you need, you are going nowhere. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_us...
Yeah, so that means the attacker has to wait for the next schedule. As I said, that's an advantage but I wouldn't classify it as a major win.
It's different if you use a different machine for the priviledged account. Then an attacker has to take over that second machine too. IMHO this is a mucher better concept, but also increases friction significantly.