2 ms·

> I don't find IAM policies to be tricky, to be honest. It may just be familiarity; I have been doing this for a little bit of time now. Then you are an elite

by ak217 10y ago

> I don't find IAM policies to be tricky, to be honest. It may just be familiarity; I have been doing this for a little bit of time now. Then you are an elite AWS operator, but you also have to think about how to teach and review work from other, less skilled operators working with you. In my experience it's not easy at all to do that with something as critical as IAM, so when I'm orchestrating resources, I heavily rely on IAM policy automation and built-in sanity checks.

eropple 10y ago
My policies are automated. I wrote the automation. :) And thank you for the compliment, but I wouldn't call myself "elite", merely "pretty good". Seriously, this is literally all it is: def kms_read_policy(contexts) contexts.map do |context| { PolicyName: "kms-read", PolicyDocument: { Version: '2012-10-17', Statement: [ { Effect: 'Allow', Action: 'kms:Decrypt' , Resource: [ Cfer.cfize('arn:aws:kms:C{AWS.region}:' \ 'C{AWS.account_id}:key/C{Fn.ref(:CredstashKey)}') ], Condition: { StringEquals: context.map do |k, v| [ "kms:EncryptionContext:#{k}", v ] end.to_h } } ] } } end.to_a end And a single DynamoDB policy in a managed policy that allows for querying the `credential-store` table. This just is not rocket science. It's helped by cfer[0] and cfer-provisioning[1] being pretty great, but it's very achievable. [0] - https://github.com/seanedwards/cfer https://github.com/seanedwards/cfer [1] - https://github.com/seanedwards/cfer-provisioning https://github.com/seanedwards/cfer-provisioning (I'm a maintainer)

by ak217 10y ago

eropple 10y ago

My policies are automated. I wrote the automation. :) And thank you for the compliment, but I wouldn't call myself "elite", merely "pretty good". Seriously, this is literally all it is: def kms_read_policy(contexts) contexts.map do |context| { PolicyName: "kms-read", PolicyDocument: { Version: '2012-10-17', Statement: [ { Effect: 'Allow', Action: 'kms:Decrypt' , Resource: [ Cfer.cfize('arn:aws:kms:C{AWS.region}:' \ 'C{AWS.account_id}:key/C{Fn.ref(:CredstashKey)}') ], Condition: { StringEquals: context.map do |k, v| [ "kms:EncryptionContext:#{k}", v ] end.to_h } } ] } } end.to_a end And a single DynamoDB policy in a managed policy that allows for querying the `credential-store` table. This just is not rocket science. It's helped by cfer[0] and cfer-provisioning[1] being pretty great, but it's very achievable. [0] - https://github.com/seanedwards/cfer https://github.com/seanedwards/cfer [1] - https://github.com/seanedwards/cfer-provisioning https://github.com/seanedwards/cfer-provisioning (I'm a maintainer)