Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IAM Is the Worst

matduggan.com

Post reply on HN
Print view View original

91–100 of 102 posts

Re: IAM Is the Worst

#91

Post by KingMob »

belter wrote: post #54
KingMob wrote: post #34

Earlier quoted context omitted.

I really love the trend of simply restating what an article argues against without addressing the actual article's points. I had an exhausting discussion on Reddit about why storing UTC is not always sufficient from commenters who continually proved they hadn't read the article or the rest of the the comments.

What about the trend of creating provocative titles, and writing blogs on the mood of: "Everybody at Google or AWS is an idiot but me"?

I'm gonna go with "a hyperbolic, but potentially-necessary corrective to the mass cargo-culting of dev practices only appropriate to global-scale organizations, with a possibly egotistical amount of clickbait self-promotion" on that one.

Re: IAM Is the Worst

#92

Post by kikimora »

poxrud wrote: post #73

IAM is complicated but it doesn’t have to be, as long as you keep things organized. - Use AWS Organizations to organize your teams into Organizational Units - use SCP to limit permissions of the OUs. - let the OUs create new aws accounts for every project/workload - now you have permissions and costs organized per project/workload Don’t be afraid to create many AWS accounts, this is encouraged and considered best pra…

This! Every team and product gets AWS account or two, this is all you need at a basic level.

Re: IAM Is the Worst

#94

Post by kikimora »

> What is this obvious solution? You, an application developer, need to launch a new service. I give you a service account that lets you do almost everything inside of that account along with a viewer account for your user that lets you go into the web console and see everything.

This is exactly what AWS Organisations do, available for many years already. This now comes with IAM Identity Center that gives you SSO into multiple AWS accounts. So the setup I use is one management account running IAM Identity Server with users and groups. Then each product gets one or few AWS accounts that they own. Super simple and effective for small organizations. For larger orgs you would need to also use SCP and maybe AWS Control Tower or similar.

Re: IAM Is the Worst

#95

Post by tetha »

belter wrote: post #82
tetha wrote: post #80

Earlier quoted context omitted.

Something similar recently tripped me up: Some parts of AWS IAM are extremely detailed and you can create insanely specific policies allowing very precise control (almost to a fault). Other parts are very broad and unspecific. For example, I recently needed to allow some EC2 instances to push a private IP around between those. I would have assumed I can create some policy along the lines of "Yeah, VMs with this role…

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses", "ec2:AttachNetworkInterface", "ec2:DetachNetworkInterface" ], "Resource": "*" } ] }

How does this control the private IP address that can be assigned? How does this stop the VM from just grabbing any IP? There isn't even anything IP-shaped in that policy.

Re: IAM Is the Worst

#96

Post by hintymad »

Worst may it be, AWS released each feature to address specific needs of their customers. Unfortunately it is hard to build a complex product with simple and consistent conceptual models as well as orthogonal product features. I'm saying this because my current company has been trying to build its own IAM system outside of cloud. Man, that is hard. So many options, so many scenarios, so many debates, and seemingly so much work. That perspective makes me appreciate how hard it is to build a flexible IAM system that supports multiple accounts, multiple roles, multiple services, multiple granularities, and multiple accessible models.

Re: IAM Is the Worst

#97

Post by hintymad »

bilalq wrote: post #57

Whether you agree with the article's recommendations or not, I do not understand how there are so many commenters saying "IAM is not that complicated". Even engineers internally at AWS frequently get tripped up with IAM permission settings. It's rare that someone gets them right on the first try. Just some of the things that make it challenging: 1. There are permissions at various layers. If anything along the chain…

And a lot of complexity comes from allowing a user or an external service to access some resources that my account owns. I remember inside AWS, an engineer who understands IAM thoroughly can have enormous influence because the engineer will easily become the go-to person for all kinds of design discussions. IAM is truly a complex beast.

Re: IAM Is the Worst

#98

Post by JackSlateur »

IAM, complicated ? Hardly. You want simple RBAC like the good old times ? You can, just use the "owner" role and move on.

You want any kind of overly thin privileges, for whatever reason ? You can too.

IAM has no complexity per se: the only complexity come from what you want to do.

Saying that "IAM is bad because we can do lots of things" is like blaming a programming language because you can implement whatever you want with it.

Re: IAM Is the Worst

#99

Post by patrick451 »

belter wrote: post #67
aggcefbhtd wrote: post #63

Earlier quoted context omitted.

Lol. “You’re just holding it wrong”. If most people find it to be difficult to use correctly, it is difficult to use correctly. Maybe that’s the best we can do but it’s still bad.

I always heard an F-16 it's a pretty easy to fly airplane ...For trained pilots. Maybe I have done Consulting at too many Startups or large Enterprise with large Cloud deployments, where most of the team seems to have barely spent some time with the docs. Some even proudly state they learned it by "looking in with colleagues"...or "on the job". Yes, it's Friday and that makes me grumpy...

The military sends F-16 pilots to a months, long dedicated flight school AFIK. How many companies send their devs to IAM school for that long? None.

Re: IAM Is the Worst

#100

Post by akerl_ »

OJFord wrote: post #42
akerl_ wrote: post #18

Earlier quoted context omitted.

> waiting for the elevated permissions I think you’re talking about something different. AWS session tokens let you use your SSO to request session tokens that have a short expiry. So you can do API/console actions but if an attacker takes the creds, they expire. It also lets you generate session tokens that only have the subset of your allowed perms that you need for that workflow.

Plus they can't assume a different role or do administrative IAM stuff.

Yea. Like, I’m 100% on board with the idea that AWS IAM is full of footguns, is overcomplicated, and is hard to get right (I assume other cloud platforms are similar, but my expertise is largely specific to AWS).

But also it’s a complex and very important problem space.

Post reply on HN