7 ms·
That describes my own personal hell with iam, and it drove me to adopt aws-cdk. aws-cdk is their infra-as-code product and it's extremely valuable for iam alon
by staticassertion 6y ago
That describes my own personal hell with iam, and it drove me to adopt aws-cdk.
aws-cdk is their infra-as-code product and it's extremely valuable for iam alone.
You can say things like: my_lambda.grantRead(s3_bucket)
And it figures out the least privileges necessary to make all of that work.
Plus it's real code, not some annoying DSL, which means you can easily abstract other iam permissions out. I have a fairly tight lambda policy that I reuse in all sorts of places, and it's as easy to use as the above snippet.
- orf 6y agoCloudformation. Ewww.
- staticassertion 6y agoSure, CF is garbage, I won't try to argue otherwise. There's this though: https://www.hashicorp.com/blog/cdk-for-terraform-enabling-python-and-typescript-support/ https://www.hashicorp.com/blog/cdk-for-terraform-enabling-py...
- zymhan 6y agoWonder what Pulumi will do to stay relevant now.
- staticassertion 6y agoPulumi probably has a better story around multicloud, but yes, it does seem like it's going to be difficult to differentiate.