Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IAM Is the Worst

matduggan.com

Post reply on HN
Print view View original

41–50 of 102 posts

Re: IAM Is the Worst

#41

Post by valenterry »

swores wrote: post #32
valenterry wrote: post #7

Earlier quoted context omitted.

> Temporary Privileges is an example of a security theater. It does not change the attack surface in a threat model because it's not temporal. Has anyone ever shown a practical evidence to support this idea? I agree. I think the benefit of this is quite low. If someone takes over your machine, things are lost anyways. If they take over your machine but for some reason cannot access your password manager (or so) or yo…

It also helps in large companies where lots of people may have needed the higher permissions over the years - if you do temporary permissions then someone currently/soon having those permissions needs to be hacked, as opposed to hacking any one of the many people who needed those permissions a few years ago and still have them because they weren't temporary and got forgotten about.

I think this is a different case though. The point of those "temporary priviledges" is not so that someone only can use them sometimes, it's that they only do use them sometimes.

What you say (that people should only have the permissions that they need) is orthogonal to that.

Re: IAM Is the Worst

#42

Post by OJFord »

akerl_ wrote: post #18
negus wrote: post #5

Earlier quoted context omitted.

Temporary Privileges is an example of security theater. It does not change the attack surface in a threat model because the model is not temporal. Has anyone ever shown a practical evidence that the attacker will face a problem waiting for the elevated permissions to support this idea? And if you still really want to do that, you don't need AWS roles as a separate concept for this. You can just use temporary membersh…

> waiting for the elevated permissions I think you’re talking about something different. AWS session tokens let you use your SSO to request session tokens that have a short expiry. So you can do API/console actions but if an attacker takes the creds, they expire. It also lets you generate session tokens that only have the subset of your allowed perms that you need for that workflow.

Plus they can't assume a different role or do administrative IAM stuff.

Re: IAM Is the Worst

#43

Post by anentropic »

lijok wrote: post #25

IAM is fine, you're just not seeing it for what it is - a low-level tool upon which an abstraction must be placed, rather than used directly. If your devs are thinking about IAM roles/permissions/whatever, your security dept failed.

are there any e.g. open source projects providing such abstractions on top of IAM?

what are you using?

Re: IAM Is the Worst

#45

Post by stefco_ »

pantulis wrote: post #12

I am well aware that identity and access authorisation is complex, and AWS, GCP and Azure desperately needed to add the capability to their portfolio as this is mandatory for enterprise sales which is where the big bucks are. But boy as soon as they started adding IAM they took all the fun out of deploying my personal shit to any cloud.

I use digitalocean for personal stuff because of this

Re: IAM Is the Worst

#47

Post by max_sendfeld »

I believe folders (or groups or similar) are the right solution to this, just not in the way that Google is implementing it. Basically, you group resources into folders and then users have read or write access to that folder.

This way, your database guys can access one big folder with all the database stuff, your server guys can access server stuff and your frontend guys can deploy to an S3 bucket, but not much more.

This is the level of granularity you need in the real world. i don't believe that any organisation, no matter how big or sophisticated has an employee that can have roles/datastore.backupsAdmin, but not roles/datastore.backupSchedulesAdmin.

Re: IAM Is the Worst

#48

Post by notsofastmrbond »

The solution that the OP says they want in the article is akin to how cloudknox (whatever it's called now and there are others) handles permissions in the big three providers.

It ingests log data and permission/role assignments then reconciles them to then allow you to create custom roles that only have the permissions that someone actually uses.

MS bought them and calls it permissions management: https://learn.microsoft.com/en-us/entra/permissions-manageme...

Palo Alto has a tool called PRISMA. https://www.paloaltonetworks.com/prisma/cloud/cloud-infrastr...

The sector of tools is called CIEM. Cloud Infrastructure Entitlement Management.

Here's the thing though...PA and MS charge PER MANAGED RESOURCE. It's crazy. This is something that should be core capability, but its an added charge. Its a space that is screaming for open source tooling to make it less rent-seek-ish.

Re: IAM Is the Worst

#50

Post by negus »

kasey_junk wrote: post #28
belter wrote: post #2

Please don't do what this article advises. These are 10 min of my life I will never get back... IAM is not that complicated. The example diagram for AWS is showing all the features available. You can use only what you require. Do two things from the beginning: 1) Least Privilege - Only the permissions required: You need to do that, because due to the constant zero days around the different software vendors, you are s…

GCP has a glaring problem with temporary privileges. The console doesn’t support them. So if there is some operational activity that a user needs to do via gui rarely you either have to manually give and take those permissions or let them sit with elevated permissions all the time. And the lack of roles of roles is beyond idiotic, it’s downright dangerous.

Just temporary add the user to yet another group with the needed permissions. Or use the IAM conditional policy. Or impersonate a service-account (which is more or less the same as asuming AWS role)

GCP's lack of "AWS role" concept is great and straigtforward. As well as its lack of both identity-bound policies and resource-bound policies at the same time.

Post reply on HN