Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IAM Is the Worst

matduggan.com

Post reply on HN
Print view View original

31–40 of 102 posts

Re: IAM Is the Worst

#31

Post by ChrisMarshallNY »

throwaway11460 wrote: post #9
kunley wrote: post #3

That hell wouldn't exist without the guys who like to endlessly and "dutifully" set up and rearrange security groups, IAM, ldap hierarchies, just in order to feel important I guess. Every company bigger than a dozen of employees has this type of guys and they are nightmare to work with; they vision is very often detached from the reality how the company works, but somehow they have the illusion that the policy existi…

These guys are often hired to implement regulation or certification requirements and the organization, if its goal is to comply, has to change its behavior and processes. Not saying your point is not true, I met guys who did it just because too. But it's not always malice or incompetence on their part.

In my company, they made the entire company PCI-compliant (as opposed to a small team of beancounters).

This meant that the janitors had the same security responsibilities as the CFO.

It was ... invigorating.

The consultants that recommended it made a lot of money, though, so I guess it's all good.

Re: IAM Is the Worst

#32

Post by swores »

valenterry wrote: post #7
negus wrote: post #5

Earlier quoted context omitted.

Temporary Privileges is an example of security theater. It does not change the attack surface in a threat model because the model is not temporal. Has anyone ever shown a practical evidence that the attacker will face a problem waiting for the elevated permissions to support this idea? And if you still really want to do that, you don't need AWS roles as a separate concept for this. You can just use temporary membersh…

> Temporary Privileges is an example of a security theater. It does not change the attack surface in a threat model because it's not temporal. Has anyone ever shown a practical evidence to support this idea? I agree. I think the benefit of this is quite low. If someone takes over your machine, things are lost anyways. If they take over your machine but for some reason cannot access your password manager (or so) or yo…

It also helps in large companies where lots of people may have needed the higher permissions over the years - if you do temporary permissions then someone currently/soon having those permissions needs to be hacked, as opposed to hacking any one of the many people who needed those permissions a few years ago and still have them because they weren't temporary and got forgotten about.

Re: IAM Is the Worst

#33

Post by ransom1538 »

belter wrote: post #2

Please don't do what this article advises. These are 10 min of my life I will never get back... IAM is not that complicated. The example diagram for AWS is showing all the features available. You can use only what you require. Do two things from the beginning: 1) Least Privilege - Only the permissions required: You need to do that, because due to the constant zero days around the different software vendors, you are s…

GCP handles #1 with their recommended actions on IAM roles. Good luck doing this manually. GCP will give adivce on each IAM role, which person hasn't used their access in 3 months and encourage you to take action (remove it).

Instead I just remove it automatically - I now automate GCP's advice. https://github.com/james-ransom/auto-apply-gcp-iam-recommend...

Re: IAM Is the Worst

#34

Post by KingMob »

jeremyjh wrote: post #6
belter wrote: post #2

Please don't do what this article advises. These are 10 min of my life I will never get back... IAM is not that complicated. The example diagram for AWS is showing all the features available. You can use only what you require. Do two things from the beginning: 1) Least Privilege - Only the permissions required: You need to do that, because due to the constant zero days around the different software vendors, you are s…

The article completely addresses the problems in #1 and you’ve offered no solutions. It offers a solution for determining what the hell the least priveleges are, while you assume prescient knowledge of them without justification. Your #2 is also exactly one of its recommendations.

I really love the trend of simply restating what an article argues against without addressing the actual article's points.

I had an exhausting discussion on Reddit about why storing UTC is not always sufficient from commenters who continually proved they hadn't read the article or the rest of the the comments.

Re: IAM Is the Worst

#35

Post by paulsutter »

The article says IAM supports what the author wants, and that it can also be used in dysfunctional ways

Article would communicate better if it started out with the idea (which is cool) rather than a long, detailed, easily misinterpreted rant

Re: IAM Is the Worst

#36

Post by wwarner »

I feel like all the innovation around wireguard is a reaction to this situation.

Cloud security, especially from AWS, is (as described elsewhere in the comments) byzantine, but I've always felt that the real underlying problem is generic advice that only serves to protect the backside of the cloud provider. What's really needed are crystal clear patterns that cover >95% of actual use cases.

Re: IAM Is the Worst

#37

Post by mnahkies »

kasey_junk wrote: post #28
belter wrote: post #2

Please don't do what this article advises. These are 10 min of my life I will never get back... IAM is not that complicated. The example diagram for AWS is showing all the features available. You can use only what you require. Do two things from the beginning: 1) Least Privilege - Only the permissions required: You need to do that, because due to the constant zero days around the different software vendors, you are s…

GCP has a glaring problem with temporary privileges. The console doesn’t support them. So if there is some operational activity that a user needs to do via gui rarely you either have to manually give and take those permissions or let them sit with elevated permissions all the time. And the lack of roles of roles is beyond idiotic, it’s downright dangerous.

It's not super user friendly but you should be able to use conditions to achieve this https://cloud.google.com/iam/docs/configuring-temporary-acce...

Re: IAM Is the Worst

#38

Post by khaki54 »

IAM could be way better with some default tools. For all I know they already exist, but I haven't seen anything close in the training or poking around.

Example, even with something as abstruse as SELlinux, you can literally just attempt whatever you're trying to do, and then pipe in the failure log into `fail2allow` and the permissions will be set to least privilege automatically and then it just works in most situations.

You can also pipe in the failure log to the policy advisor and it spits out a bunch of advice in plain text as well as a copy / paste command to implement it.

IAM is horrible if it can take design notes from SELinux.

Re: IAM Is the Worst

#39

Post by DonHopkins »

The cognitive dissonance from trying to keep both AWS IAM and GCS IAM in my head at the same time, when they're almost but not quite entirely unlike each other, is maddening and gives me Induced Dissociative Identity Disorder (IDID).

They should merge them together into one big happy standard, and call it Worldwide Enterprise Access Rights Environment (WEARE).

Maybe if they signed up enough celebrities to sing a song about it, it would make the world a better place...

https://www.youtube.com/watch?v=s3wNuru4U0I

https://www.youtube.com/watch?v=4tLvzyb3_Uc

Re: IAM Is the Worst

#40

Post by jchw »

I agree with people saying IAM is not that complicated. On the other hand, I think I also agree that IAM is extremely complicated. It's both. I'm serious!

The problem with IAM isn't the functionality it offers; it's almost exactly what you want. I mean look at what it actually does, isn't it literally exactly what you would do? Sure, maybe the terms are confusing or something, but on the whole... it's hard to argue that what it offers isn't basically what you want. You want to allow identities, to do things. You group those things into roles. And so on.

That said, the more powerful and granular permissions and ACLs get, the more grand the architecture you have to craft to make good use of it, and I think at some point, your own IAM rules become a work of engineering themselves. You wind up having to specifically engineer around and for IAM. This is not unique to cloud IAM; when doing complex NixOS setups, I have occasionally realized that my webs of plumbing secrets through SOPS to systemd units, and setting up group permissions for UNIX domain sockets between services, winds up getting quite complex quite quickly, and that it is basically, yes, engineering of its own sort. And if you add cgroups and network namespaces and nftables rules and seccomp, god help you, it's even worse than IAM! And that's just on a single machine...

Post reply on HN