Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Iamlive – Generate an IAM policy from AWS client-side monitoring

github.com

Post reply on HN
Print view View original

21–30 of 36 posts

Re: Iamlive – Generate an IAM policy from AWS client-side monitoring

#21

Post by flurie »

joshuanapoli wrote: post #6

Iamlive sounds useful for someone who has something running with wide open permissions and wants to get started with narrowing down the permissions. It wastes a lot of time to discover necessary permissions one-by-one through permission-denied errors. Tag-based policies (attribute based access control) really simplifies IAM policy management. These are more reusable, so there is permission discovery isn’t needed as o…

ABAC is ideally much more than just scoping small sets of policy to tags. I think the problem of trying to shoehorn ABAC into AWS's IAM system, even with something implementing proper ABAC on top of it, is that you run the risk of hitting limits on role policy attachments (hard limit of 20!). There is probably a way to juggle user function across different roles, though then there's a risk of exhausting roles or still not being able to shoehorn a minimally viable policy for some function based on fine-grained attributes.

Re: Iamlive – Generate an IAM policy from AWS client-side monitoring

#23

Post by zackmorris »

rasguanabana wrote: post #18
zackmorris wrote: post #13

I've dabbled in dev ops in recent months and found that setting up AWS services is relatively straightforward. Although for anyone reading this, do yourself a favor right now and learn to automate the manual steps with something like Terraform or you'll most likely never get anywhere in any reasonable amount of time. I found IAM to be an anti-pattern. I grew up on the Mac in a sandboxed, single-user environment with…

On one hand you have people setting wildcards in IAM policies for development phase (and forgetting to close them down afterwards). It’s hard to figure out permissions beforehand - this would help in these cases, but still taking IAM setup deduced from your traffic does not mean this setup is secure. On the other hand you have complex architectures and no real overlap in their authorization patterns. It’s impossible…

Ya I've done that hah. I think an ok plan might be to set up infrastructure with open IAM rules and write all of the backend and frontend acceptance tests for an app. Then close all IAM rules and open them one by one until all of the tests pass again.

Maybe AWS could provide a way to track access attempts and then have an interface for the user to grant them one by one. I understand that this might be challenging to design, but I view these sorts of challenges as the "real work" of computer science, otherwise there's just nothing there.

I encounter that a lot when I have a preconceived notion of the heart of a strategy (including edge cases), only to find that it wasn't addressed, and in fact wasn't even mentioned.

Yes these things are hard, but Amazon has billions and billions of dollars.

Re: Iamlive – Generate an IAM policy from AWS client-side monitoring

#24

Post by orf »

I think IAM is really, really cool. I’ve always wondered: is IAM a service under the hood? Surely not - the volume of requests would be insane and the single point of failure pretty risky.

So is it a spec with some kind of shared data plane to retrieve policies? If so how would they be evaluated consistently across different languages? Producing a shared library that does this in all contexts/languages sounds improbable. But then the policies are clearly compiled to some kind of bytecode, so a common implementation would make sense. But then again it is something that would definitely benefit from centralisation.

Re: Iamlive – Generate an IAM policy from AWS client-side monitoring

#25

Post by uzakov »

zackmorris wrote: post #20
uzakov wrote: post #14

Earlier quoted context omitted.

Hey! So to touch on a couple of points: Scott Piper is probably one of the most known AWS sec experts, check out his websites. https://summitroute.com/blog/ "Any approaches to formally proving that IAM roles and permissions are secure would be greatly appreciated! " Are you looking for a way to see that you have set up your policies correctly?

Ya after writing it, I think what's going on is that I do everything declaratively now. So it's great that AWS lets us create the AWS policy files rather than making us manage permissions through code. But I want to see the infrastructure as a big spreadsheet, turn on a policy, and see the accessible services highlight. basically I need something like an acceptance/integration test that proves that my permissions wor…

Dont worry, I didn't feel that you were a "negative nancy" :)

> "But I want to see the infrastructure as a big spreadsheet, turn on a policy, and see the accessible services highlight. basically I need something like an acceptance/integration test that proves that my permissions work like I think they do."

This problem can be solved by having your infrastructure etc as Terraform templates, and writing unit tests for those. Additionally you can use 3rd party solutions, depending on what you mean by "see the accessible services highlight"

> " I don't think it makes sense to screen access by which network was used, or the source IP of the user trying to gain access."

I would say this is additional thing you would do, but not the only.

> "But maybe there's some advantage with roles and permissions that I'm not seeing."

Let me/us know and maybe either me or someone else can help you. Hopefully my message didnt come as condescending. PS I dont work for AWS

Re: Iamlive – Generate an IAM policy from AWS client-side monitoring

#26

Post by yandie »

orf wrote: post #24

I think IAM is really, really cool. I’ve always wondered: is IAM a service under the hood? Surely not - the volume of requests would be insane and the single point of failure pretty risky. So is it a spec with some kind of shared data plane to retrieve policies? If so how would they be evaluated consistently across different languages? Producing a shared library that does this in all contexts/languages sounds improba…

ex-AWS here. IAM is definitely a service! It's super powerful underneath the hood.

However as a caller, you need multiple levels of caching underneath the hood (all built by IAM team). That's part of the reasons why you can't use IAM as an external service.

IAM is also eventual consistency - that's why if you modify the policy doc it takes seconds to reflect in your service calls :) (sometimes even minutes). IAM outages can and will take down multiple AWS services.

> If so how would they be evaluated consistently across different languages?

Internally everything is JVM AFAIK :). If you go out of the JVM world in AWS you'll have to deal with this problem yourself, which can be painful.

Re: Iamlive – Generate an IAM policy from AWS client-side monitoring

#27

Post by orf »

yandie wrote: post #26
orf wrote: post #24

I think IAM is really, really cool. I’ve always wondered: is IAM a service under the hood? Surely not - the volume of requests would be insane and the single point of failure pretty risky. So is it a spec with some kind of shared data plane to retrieve policies? If so how would they be evaluated consistently across different languages? Producing a shared library that does this in all contexts/languages sounds improba…

ex-AWS here. IAM is definitely a service! It's super powerful underneath the hood. However as a caller, you need multiple levels of caching underneath the hood (all built by IAM team). That's part of the reasons why you can't use IAM as an external service. IAM is also eventual consistency - that's why if you modify the policy doc it takes seconds to reflect in your service calls :) (sometimes even minutes). IAM outa…

Thanks! That’s super interesting. There’s something really cool about building something as flexible and (presumably) fast as IAM.

The caching layer must also be quite complex! But thanks for settling this for me.

Re: Iamlive – Generate an IAM policy from AWS client-side monitoring

#28

Post by musingsole »

zackmorris wrote: post #23
rasguanabana wrote: post #18

Earlier quoted context omitted.

On one hand you have people setting wildcards in IAM policies for development phase (and forgetting to close them down afterwards). It’s hard to figure out permissions beforehand - this would help in these cases, but still taking IAM setup deduced from your traffic does not mean this setup is secure. On the other hand you have complex architectures and no real overlap in their authorization patterns. It’s impossible…

Ya I've done that hah. I think an ok plan might be to set up infrastructure with open IAM rules and write all of the backend and frontend acceptance tests for an app. Then close all IAM rules and open them one by one until all of the tests pass again. Maybe AWS could provide a way to track access attempts and then have an interface for the user to grant them one by one. I understand that this might be challenging to…

This is a thriving service market at the moment. DivvyCloud is an example: https://aws.amazon.com/solutionspace/financial-services/solu...

Re: Iamlive – Generate an IAM policy from AWS client-side monitoring

#30

Post by musingsole »

DSingularity wrote: post #29

Google cloud got IAM right. I know of no approach to AWS IAM other than start with granting all perms and then begin to reduce privilege until things break. AWS is untenable.

I've always worked in the AWS world and have only dabbled in google cloud, but hot rocks on a sunday evening if this clear page isn't refreshing coming from AWS: https://cloud.google.com/iam/docs/permissions-reference
Post reply on HN