3 ms·

What services aren't currently integrated with IAM / didn't launch with IAM integration?

• p_l 4y ago
  AWS Quicksight was one, late 2020-early 2021 (which is about 5+ years after acquisition, iirc). IAM support was essentially useless, you had to create second set of accounts inside Quicksight, with various limitations, and generally it was one hell of a mess.
• destroy-2A 4y ago
  Also when IAM integration is there it has patchy support for resource condition wildcards and condition keys which are usually not documented
  • philsnow 4y ago
    Totally agreed there. Also condition keys have such a high cognitive load; I can never ever remember the exact spelling of them or whether I need StringEqual or StringIsEqualIfExists or whatever other operator. The documentation has tons of prose about what service-specific keys to expect, but nearly 100% of the time when I'm trying to do something non-trivial with IAM, I end up finding the answer on somebody's blog rather than the documentation. All of this because the policy language and featureset started off simple enough that it was reasonable to describe policies in json. I sort of wish that they would keep the existing policy stuff as-is but have an escape hatch that let us write lua (or JS or eBPF or something) as "policies", and charge us for the compute time.
    • p_l 4y ago
      I recall that there was at least one case where two similar condition keys that by name should work both, only one was appropriate. But then I actually blew the stack in IAM processing to the point we couldn't start an AWS sagemaker notebook because IAM died while attaching a network interface to EC2...
• jjoonathan 4y ago
  S3 had poor integration with IAM until a few months ago. I'm glad we have bucket-owner-enforced now, but the correct time to add it was 10 years ago.