3 ms·
> AWS security is so complicated now, at the control plane layer, that hardly anyone understands it. IAM and security management are the worst parts of AWS. It
by driverdan 7y ago
> AWS security is so complicated now, at the control plane layer, that hardly anyone understands it.
IAM and security management are the worst parts of AWS. It's complex an unintuitive. I always second guess my choices, wondering if I've left a gaping security hole somewhere.
- ledgerdev 7y agoI too have been wondering the same. Does anyone else see a need for some external service that examines resources/permissions and give a clear picture and ongoing monitoring for changes? Are there any services that already do this well?
- edoceo 7y agoAmazon makes one https://aws.amazon.com/config/ https://aws.amazon.com/config/
- tacon 7y agoAWS has an automated reasoning group working on tools to help answer the high level questions about complicated policy configurations. [0] has been submitted four times to Hacker News, and received a total of 4 points and 0 comments. [0] https://aws.amazon.com/blogs/security/protect-sensitive-data-in-the-cloud-with-automated-reasoning-zelkova/ https://aws.amazon.com/blogs/security/protect-sensitive-data... [1] https://aws.amazon.com/security/provable-security/ https://aws.amazon.com/security/provable-security/
- satanspastaroll 7y agoWhat I'd like to see is larger space for custom rules. You can't have a single policy that defines a whitelist of functions you can do on an EC2 instance per user.