4 ms·
What kind of policies were you writing? IAM is structured in a hierarchical fashion to limit policy complexity so that performance is fairly consistent at the c
by jzelinskie 5y ago
What kind of policies were you writing? IAM is structured in a hierarchical fashion to limit policy complexity so that performance is fairly consistent at the cost of expressiveness. Zanzibar-like systems tend not to limit the complexity/expressiveness, by instead relying on denormalized views of the data to keep queries fast.
Disclaimer: I'm a founder of authzed (YC W21), a productized Zanzibar implementation
- p_l 5y agoWhat we know is that we started to have increasing amounts of "policy is too big" errors in AWS APIs. Not IAM APIs. But things like Sagemaker being unable to start an EC2 instance because the networking system couldn't evaluate IAM policy (the error messages were annoying in both being quite specific and not helpful ultimately). The computational complexity of the policies wasn't high (in fact, they were pretty much key-value things, as the only time we had something more complex was in AssumeRoleUsingWebIdentity calls - btw, that API sucks, embarassingly so - everything else was plain list of what a role could access).