3 ms·

> What more do you want? The hard part for me is figuring out how to disable access without breaking everything. I know it’ll be useful once I understand and

• donavanm 6y ago
  Have you tried Access Advisor in AWS IAM? It’s been out for a few years now and is specifically targeted at using “... last accessed information to refine your policies and allow access to only the services and actions that your entities use.” Can you explain how IAM doesn’t work well with the “starting closed” approach? IAM authorization is “default deny” and every principal needs an explicit allow statement with the appropriate action before authorization will pass.
  • ryan29 6y ago
    I’ll give it a try. Thanks! > Can you explain how IAM doesn’t work well with the “starting closed” approach? It works ok once you do a lot of learning and read the best practices. I think a lot of people will skip that and use their root account for everything. The biggest mistake I made was creating an admin user, but giving it too many permissions and using it like a normal user. After learning more I use the root account to make an admin account, but I think the admin account should only use IAM to create other fine grained users. So it works fine, but I think it would be better to force people into creating those first couple of accounts with permissions chosen by experts. It’s too easy to jump right in and start using an over privileged account.