19 ms·
Not sure on IAM, but Google put out a paper on Zanzibar. https://research.google/pubs/pub48190/ https://research.google/pubs/pub48190/
by bpicolo 5y ago
Not sure on IAM, but Google put out a paper on Zanzibar.
https://research.google/pubs/pub48190/ https://research.google/pubs/pub48190/
- kimburgess 5y agoAuth0 are also working on a Zanzibar inspired system. Some interesting notes on their exploration via: https://twitter.com/auth0lab https://twitter.com/auth0lab
- p_l 5y agoI can confirm that IAM works definitely not like Zanzibar - in last job we have started to regularly hit issues where various AWS components would refuse to work because IAM Policy got too big, so it's definitely not querying another API for specific permissions but somehow goes around with the whole resulting policy :-|
- jzelinskie 5y agoWhat kind of policies were you writing? IAM is structured in a hierarchical fashion to limit policy complexity so that performance is fairly consistent at the cost of expressiveness. Zanzibar-like systems tend not to limit the complexity/expressiveness, by instead relying on denormalized views of the data to keep queries fast. Disclaimer: I'm a founder of authzed (YC W21), a productized Zanzibar implementation
- p_l 5y agoWhat we know is that we started to have increasing amounts of "policy is too big" errors in AWS APIs. Not IAM APIs. But things like Sagemaker being unable to start an EC2 instance because the networking system couldn't evaluate IAM policy (the error messages were annoying in both being quite specific and not helpful ultimately). The computational complexity of the policies wasn't high (in fact, they were pretty much key-value things, as the only time we had something more complex was in AssumeRoleUsingWebIdentity calls - btw, that API sucks, embarassingly so - everything else was plain list of what a role could access).