Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 79 posts

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#31

Post by Eridrus »

IAM is horrific, but I feel like it's not really the application-specific stuff that is annoying for me, it's the stuff that AWS wants configured for AWS features to work and the fact that the error messages when you get it wrong are useless at pinpointing your mistake, when you do not know that access is mediated by IAM.

Just as an example, I setup a containerized app on Fargate with a custom role, and the need to configure the ability for ecs to assume the role, read from ecr, write to cloudwatch, create channels for debugging was super annoying.

Comparatively, having a policy for it to read from an s3 bucket with my data was trivial.

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#32

Post by kkapelon »

lijok wrote: post #26
DanielSlauth wrote: post #3

Earlier quoted context omitted.

Do you think humans are doing a better job? Research shows that 95% of the permissions granted to users aren't used which creates huge problems and is a reason for spending millions in security tools. Why not use Slauth and other checks such as policy simulators to get tightened policies pre-deployed

> Research shows that 95% of the permissions granted to users aren't used These would be the "s3:*" and "Resources: *" scoped permissions I assume? I can't imagine users are explicitly typing out permissions, 95% of which are not relevant for the task. > which creates huge problems Such as? What is the material impact of a workflow or a user having too many permissions? > and is a reason for spending millions in secu…

> Such as? What is the material impact of a workflow or a user having too many permissions?

Security obviously https://en.wikipedia.org/wiki/Principle_of_least_privilege

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#33

Post by candiddevmike »

DanielSlauth wrote: post #3
verdverm wrote: post #2

Repost: https://news.ycombinator.com/item?id=34038663 (11 months ago) > We employ Large Language Models (currently OpenAI GPT-4) For IAM, this seems like a disaster waiting to happen. Combining hallucination problems with security settings is not a path I would consider

Do you think humans are doing a better job? Research shows that 95% of the permissions granted to users aren't used which creates huge problems and is a reason for spending millions in security tools. Why not use Slauth and other checks such as policy simulators to get tightened policies pre-deployed

AWS and GCP already provide tools to show excess permissions...

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#34

Post by lasermike026 »

Eridrus wrote: post #31

IAM is horrific, but I feel like it's not really the application-specific stuff that is annoying for me, it's the stuff that AWS wants configured for AWS features to work and the fact that the error messages when you get it wrong are useless at pinpointing your mistake, when you do not know that access is mediated by IAM. Just as an example, I setup a containerized app on Fargate with a custom role, and the need to c…

You get used to it.

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#35

Post by lijok »

I'd like to challenge you on what seems to be the main claim behind why Slauth is a necessary product: "the amount of money that is being spent on tooling to scan for IAM misconfigurations in the cloud".

1. The tooling you're quoting specifically, wiz.io and ermetic.com do an incredible amount more than just "scan for IAM misconfigurations". In fact, I understand that to be one of their most insignificant features. Yet it sounds, from the numbers being quoted (I saw the "millions" figure being thrown around), that you are equating a company purchasing wiz.io as them purchasing "tooling to scan for IAM misconfigurations" exclusively. How much does the IAM scanning tooling actually cost, and what is the material cost of delayed remediation of over-permissioned entities?

2. Were a company to introduce Slauth into their stack, are you under the impression that they would then not need to scan their IAM for misconfigurations and would therefore be able to save "millions"? Would it not be fair to say that the presence of Slauth would not remove the need for IAM scanning tools, since IAM deployments could happen out of bounds, which is not something that Slauth removes from a companies threat model?

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#36

Post by verdverm »

kkapelon wrote: post #32
lijok wrote: post #26

Earlier quoted context omitted.

> Research shows that 95% of the permissions granted to users aren't used These would be the "s3:*" and "Resources: *" scoped permissions I assume? I can't imagine users are explicitly typing out permissions, 95% of which are not relevant for the task. > which creates huge problems Such as? What is the material impact of a workflow or a user having too many permissions? > and is a reason for spending millions in secu…

> Such as? What is the material impact of a workflow or a user having too many permissions? Security obviously https://en.wikipedia.org/wiki/Principle_of_least_privilege

That is the "theoretical" problem

How many times have excess permissions "actually" been the problem... versus something like correct permissions with compromised credentials?

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#37

Post by lijok »

kkapelon wrote: post #32
lijok wrote: post #26

Earlier quoted context omitted.

> Research shows that 95% of the permissions granted to users aren't used These would be the "s3:*" and "Resources: *" scoped permissions I assume? I can't imagine users are explicitly typing out permissions, 95% of which are not relevant for the task. > which creates huge problems Such as? What is the material impact of a workflow or a user having too many permissions? > and is a reason for spending millions in secu…

> Such as? What is the material impact of a workflow or a user having too many permissions? Security obviously https://en.wikipedia.org/wiki/Principle_of_least_privilege

If you're trying to sell a tool, you don't justify its cost by saying it addresses "huge problems" such as "security". Lets talk material impact; how will this tool pay for itself?

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#38

Post by verdverm »

lijok wrote: post #37
kkapelon wrote: post #32

Earlier quoted context omitted.

> Such as? What is the material impact of a workflow or a user having too many permissions? Security obviously https://en.wikipedia.org/wiki/Principle_of_least_privilege

If you're trying to sell a tool, you don't justify its cost by saying it addresses "huge problems" such as "security". Lets talk material impact; how will this tool pay for itself?

I think it's supposed to be like insurance. The cost of bad things happening inspires you to pay for things that give you peace of mind. I don't trust LLMs to give me peace of mind for security tasks, if anything, the opposite

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#39

Post by coredog64 »

verdverm wrote: post #2

Repost: https://news.ycombinator.com/item?id=34038663 (11 months ago) > We employ Large Language Models (currently OpenAI GPT-4) For IAM, this seems like a disaster waiting to happen. Combining hallucination problems with security settings is not a path I would consider

If it was me, I’d still run QC tools on the generated policy just like I would for manually authored policies. Specific to AWS, the IAM Access Analyzer will confirm that you’re using correct grammar. Further, there are techniques like SCP and permission boundaries to downscope what would normally be all actions/resources.

Re: Launch HN: Slauth (YC S22) – auto-generate secure IAM policies for AWS and GCP

#40

Post by rtkwe »

lijok wrote: post #26
DanielSlauth wrote: post #3

Earlier quoted context omitted.

Do you think humans are doing a better job? Research shows that 95% of the permissions granted to users aren't used which creates huge problems and is a reason for spending millions in security tools. Why not use Slauth and other checks such as policy simulators to get tightened policies pre-deployed

> Research shows that 95% of the permissions granted to users aren't used These would be the "s3:*" and "Resources: *" scoped permissions I assume? I can't imagine users are explicitly typing out permissions, 95% of which are not relevant for the task. > which creates huge problems Such as? What is the material impact of a workflow or a user having too many permissions? > and is a reason for spending millions in secu…

It's the constant tug of war between the idealized security status where users have just enough access to do their jobs and the fact that it's hard to know the precise access you need until you get the task at which point the idealized process of review to grant access takes too long and really drags down your development pace.

At my job for example we don't have a separate support team for the ETL work we do so I have a lot of access I don't use unless things are breaking and then I can't wait for the access approval process to get added to database XXX or bucket YYY to diagnose what data has broken our processes.

Post reply on HN