4 ms·

Can you talk a bit about the security model? Appliku requires an AWS user with: AmazonEC2FullAccess AmazonEC2ContainerRegistryFullAccess AmazonEC2ContainerSe

Can you talk a bit about the security model? Appliku requires an AWS user with: AmazonEC2FullAccess AmazonEC2ContainerRegistryFullAccess AmazonEC2ContainerServiceFullAccess AmazonS3FullAccess That's a lot of permissions into my AWS account. What are some easy ways to contain the damage that could be done if Appliku has a bug or the creditials are compromised?

appliku 5y ago
Hey! Thanks for question. I guess there is an article that needs updating. Appliku only needs AmazonEC2FullAccess. Well, if you feel that something is off you just revoke credentials. I will update the article now. Thanks again
- mikepurvis 5y ago
  The point of a rich authorization model is not to have to rely on feelings.
deberon 5y ago
I would recommend dedicating an entire AWS account to this. Or, if you have a solid tagging strategy[0], you can craft your IAM policies to only allow Appliku access to resources tagged with a particular tag. 0 - https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags...
- appliku 5y ago
  Separate account will be the best strategy. I prefer having separate accounts for every project. Hustle to login between them, but the best isolation that can be between projects.
  - jpmoral 5y ago
    Sorry, 'hassle' not 'hustle'.
onphonenow 5y ago
Google got this right w project focused permissions- accounts work aws side but