Iamlive – Generate an IAM policy from AWS client-side monitoring
1–10 of 36 posts
Re: Iamlive – Generate an IAM policy from AWS client-side monitoring
#2I can’t really judge the usefulness of this tool as I’m not that familiar with IAM, but I’d be wary of using this in a work situation because I would be really worried I’d accidentally search for “imlive”, which is an adult cam site.
Maybe I’m just being paranoid but it feels like if I unintentionally named my super useful and totally innocuous project “poorNHub”, I’d want someone to point out how that might cause problems down the line for adoption.
Re: Iamlive – Generate an IAM policy from AWS client-side monitoring
#3I can’t really judge the usefulness of this tool as I’m not that familiar with IAM, but I’d be wary of using this in a work situation because I would be really worried I’d accidentally search for “imlive”, which is an adult cam site. Maybe I’m just being paranoid but it feels like if I unintentionally named my super useful and totally innocuous project “poorNHub”, I’d want someone to point out how that might cause pr…
Fair point. But what would happen? Even if you accidentally opened that site, most probably nobody would have noticed. Or it would have been just a short awkward moment.
Re: Iamlive – Generate an IAM policy from AWS client-side monitoring
#4I can’t really judge the usefulness of this tool as I’m not that familiar with IAM, but I’d be wary of using this in a work situation because I would be really worried I’d accidentally search for “imlive”, which is an adult cam site. Maybe I’m just being paranoid but it feels like if I unintentionally named my super useful and totally innocuous project “poorNHub”, I’d want someone to point out how that might cause pr…
Fair point. But what would happen? Even if you accidentally opened that site, most probably nobody would have noticed. Or it would have been just a short awkward moment.
Not in me too time.
One good solution - turn on adult content blocking on firewall. Saved me once or twice if you typo, missearch etc. I'm usually like huh when it blocks? Then oh...
Re: Iamlive – Generate an IAM policy from AWS client-side monitoring
#5This is a great approach to determine permission especially for service accounts - thanks for giving me another tool for my toolchain.
Re: Iamlive – Generate an IAM policy from AWS client-side monitoring
#6Iamlive sounds useful for someone who has something running with wide open permissions and wants to get started with narrowing down the permissions. It wastes a lot of time to discover necessary permissions one-by-one through permission-denied errors.
Tag-based policies (attribute based access control) really simplifies IAM policy management. These are more reusable, so there is permission discovery isn’t needed as often.
Re: Iamlive – Generate an IAM policy from AWS client-side monitoring
#7I’d never heard of the Client Side Monitoring tooling that this appears to be using. Is anyone in here using it to any effect?
Re: Iamlive – Generate an IAM policy from AWS client-side monitoring
#8I’d never heard of the Client Side Monitoring tooling that this appears to be using. Is anyone in here using it to any effect?
It's a "hidden" (in that it's not documented very well or advertised much by AWS) feature of the AWS SDKs. I think it was likely added for debugging purposes originally, but security tools have started to hook into it as a more local and compete version of the kinds of logs you'd see in CloudTrail.
I've used it mostly for debugging and temporary monitoring of service calls.
https://summitroute.com/blog/2020/05/25/client_side_monitori...
Re: Iamlive – Generate an IAM policy from AWS client-side monitoring
#9I’d never heard of the Client Side Monitoring tooling that this appears to be using. Is anyone in here using it to any effect?
I'm curious if the tooling could be made to work with a "default deny" policy, that is, is there enough info to generate the IAM policies when you get "permission denied"?
Re: Iamlive – Generate an IAM policy from AWS client-side monitoring
#10Iamlive sounds useful for someone who has something running with wide open permissions and wants to get started with narrowing down the permissions. It wastes a lot of time to discover necessary permissions one-by-one through permission-denied errors. Tag-based policies (attribute based access control) really simplifies IAM policy management. These are more reusable, so there is permission discovery isn’t needed as o…
could you expand on that? my familiarity is very limited with IAM (as fun as getting teeth pulled), and this sounds interesting.