3 ms·

I have a question, I recently had the opportunity to use AWS CDK (https://docs.aws.amazon.com/cdk/latest/guide/home.html https://docs.aws.amazon.com/cdk/latest/

I have a question, I recently had the opportunity to use AWS CDK (https://docs.aws.amazon.com/cdk/latest/guide/home.html https://docs.aws.amazon.com/cdk/latest/guide/home.html) for a project. It seemed to me that CDK automatically does this to a certain degree and if CDK is the future for AWS infrastructure provisioning, this issue should organically go away. Anyone have any input?

kmcquade 7y ago
I haven't used the AWS CDK before. I'm more of a Terraform guy. But at a glance, I don't think it solves the issue with access levels and resource ARNs. You can still create IAM policies that have s3:wildcard, or `service:someaction` against wildcard resources. Essentially: Even when Infrastructure as Code exists, IAC developers can still make security mistakes. Our goal with this tool was to automate the process (it is way faster to build policies with this), and by default, restrict actions according to resource ARNs. I haven't seen any other tool do that to this degree, although I would be pleasantly surprised to learn about any that do. Edit: Not sure why HN is blocking out the wildcard character.
k__ 7y ago
I don't know if it's really the future, but at least it's an alternative. Some people claim it's the wrong way, because it's another abstraction between a CFN-template and the CFN-engine (more moving parts, etc) and using a markup language that restricts you a bit, makes things more manageable.
crucialfelix 7y ago
It does make it easier to create and change policies, and this increases your development velocity and hence the chance that youll dedicate enough time to security. Some of the higher level constructs apply smart rules. Eg adding a load balancer target adds restricted access rules. It's still hard to know what's been created and how everything is connected. I made a graph visualization tool that live updates from a Cloudformation file. It solved all my visibility and understanding issues. I plan to release it soon.

kmcquade 7y ago

I haven't used the AWS CDK before. I'm more of a Terraform guy. But at a glance, I don't think it solves the issue with access levels and resource ARNs. You can still create IAM policies that have s3:wildcard, or `service:someaction` against wildcard resources. Essentially: Even when Infrastructure as Code exists, IAC developers can still make security mistakes. Our goal with this tool was to automate the process (it is way faster to build policies with this), and by default, restrict actions according to resource ARNs. I haven't seen any other tool do that to this degree, although I would be pleasantly surprised to learn about any that do. Edit: Not sure why HN is blocking out the wildcard character.

k__ 7y ago

I don't know if it's really the future, but at least it's an alternative. Some people claim it's the wrong way, because it's another abstraction between a CFN-template and the CFN-engine (more moving parts, etc) and using a markup language that restricts you a bit, makes things more manageable.

crucialfelix 7y ago

It does make it easier to create and change policies, and this increases your development velocity and hence the chance that youll dedicate enough time to security. Some of the higher level constructs apply smart rules. Eg adding a load balancer target adds restricted access rules. It's still hard to know what's been created and how everything is connected. I made a graph visualization tool that live updates from a Cloudformation file. It solved all my visibility and understanding issues. I plan to release it soon.