4 ms·

Maybe a stupid question, but isn't IAM related to almost any API access to AWS as it's used for authorization and authentication through a combination of identi

Maybe a stupid question, but isn't IAM related to almost any API access to AWS as it's used for authorization and authentication through a combination of identities and policies? Or does this outage only affect the meta level being access to IAM itself through its own API?

acdha 6y ago
The last time this happened I saw errors changing IAM entities but not using them or getting STS tokens, which made sense if it was related to propagating changes.
- ManWith2Plans 6y ago
  This is what I experienced this time too. Still impacts development significantly if you use a tool like terraform.
  - acdha 6y ago
    Definitely – just changes it from “critical - the world is on fire” to “major”.
sofal 6y ago
There are 3 basic ways in which you might see an IAM/Identity related issue: 1. Control plane problems - these will manifest as latency or errors when calling the IAM service itself to make updates/additions/deletions of users/roles/policies/groups/etc. This is the most likely scenario if the dashboard names "IAM" specifically as the issue. 2. Propagation problems - problems with propagation will manifest as delays in seeing your control plane (IAM) actions reflected in the dataplane. For example, if you remove a user, but the user is still able to authenticate to AWS services for a lengthy period of time. 3. Dataplane problems - this will be problems with authentication or authorization to any and all AWS services. A widespread problem with authentication is less likely, but extremely bad, and will probably not be categorized in the dashboard as a problem only with IAM, since "IAM" is technically the name of the control plane.
deleted 6y ago
[deleted]
mcqueenjordan 6y ago
[Disclaimer: I'm speaking as an engineer personally, not for any company.] My understanding is that authz/authn flows have not been affected. If authz/authn flows (which occur on every API call) were affected, I suspect the effect would be far more noticeable.
birdyrooster 6y ago
IAM is probably decentralized using trusted CA certificates to allow other AWS services to validate tokens previously created by IAM when it wasn't down. Yeah if you want new tokens you are just out of luck, but existing ones will keep working.

acdha 6y ago

The last time this happened I saw errors changing IAM entities but not using them or getting STS tokens, which made sense if it was related to propagating changes.

ManWith2Plans 6y ago
This is what I experienced this time too. Still impacts development significantly if you use a tool like terraform.
- acdha 6y ago
  Definitely – just changes it from “critical - the world is on fire” to “major”.

sofal 6y ago

There are 3 basic ways in which you might see an IAM/Identity related issue: 1. Control plane problems - these will manifest as latency or errors when calling the IAM service itself to make updates/additions/deletions of users/roles/policies/groups/etc. This is the most likely scenario if the dashboard names "IAM" specifically as the issue. 2. Propagation problems - problems with propagation will manifest as delays in seeing your control plane (IAM) actions reflected in the dataplane. For example, if you remove a user, but the user is still able to authenticate to AWS services for a lengthy period of time. 3. Dataplane problems - this will be problems with authentication or authorization to any and all AWS services. A widespread problem with authentication is less likely, but extremely bad, and will probably not be categorized in the dashboard as a problem only with IAM, since "IAM" is technically the name of the control plane.

deleted 6y ago

[deleted]

mcqueenjordan 6y ago

[Disclaimer: I'm speaking as an engineer personally, not for any company.] My understanding is that authz/authn flows have not been affected. If authz/authn flows (which occur on every API call) were affected, I suspect the effect would be far more noticeable.

birdyrooster 6y ago

IAM is probably decentralized using trusted CA certificates to allow other AWS services to validate tokens previously created by IAM when it wasn't down. Yeah if you want new tokens you are just out of luck, but existing ones will keep working.