4 ms·

IAM has really made me aware of my limitations as a run of the mill engineer and has me worried that it's exposed the boundaries of how far I can really scale.

IAM has really made me aware of my limitations as a run of the mill engineer and has me worried that it's exposed the boundaries of how far I can really scale. I keep telling myself that if I could simply get a couple days, uninterrupted, to focus on it, take it in, reflect, that I could become comfortable with it. But it never happens.

digitalsushi 4y ago
That said, this article cleared up a little bit of permission boundaries. It's now clearer to me that my organization is doing what the article speaks of, with cross-accounts and permission boundaries, and having the two-layer-admin clarified has not made my understanding worse. Good article.
jfengel 4y ago
That has been my experience as well. I don't understand it well enough to say that it's more complicated than it needs to be, but it's certainly clear that there is no obvious on-ramp. Everything starts locked down, and opening up anything requires figuring out which of numerous options gives you what you need without inviting the entire universe in. Usually, the best way to learn is by experimentation. But with security, your "experiments" might leave you exposed. Or at least, leave your system in some nonstandard state, making it even harder to figure out what the correct route was supposed to be. It's why I've been happy to use things like netlify. They may not scale, but at least it feels like I can get a project up without it becoming an ordeal of opening permissions. It's not my main line of work, and as you say, I imagine I would figure it out if I did it consistently for a bit. But every time I start a side project using AWS, IAM scares me off.
- technion 4y ago
  I would suggest azure has an approach that shows how iam can be a lot simpler. I can create a resource group, and make you a contributor on that group. You now have full permissions to servers, storage and anything else created under that group without me having to enumerate them. If I want to create a new blob store under that group, you already have access without me having to edit iam. I can still make granular permissions where suitable. Azure makes the path to having all console users require mfa much simpler too.
  - vdm 4y ago
    Thanks for sharing this perspective. AWS IAM does have resource condition keys which allow matching resources by account, org, org path, and tag. Resources in a Cloudformation stack would be automatically tagged, for example. https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p...
InfoSecErik 4y ago
This diagram was pretty critical in helping me "get it": https://docs.aws.amazon.com/IAM/latest/UserGuide/images/PolicyEvaluationHorizontal111621.png https://docs.aws.amazon.com/IAM/latest/UserGuide/images/Poli...
- digitalsushi 4y ago
  Thank you for taking the time to link this. I appreciate it, this is indeed very helpful.
darraghenright 4y ago
I think you're being a little harsh on yourself, but I can emphatise. Every time I need to do something IAM related that's beyond the obvious, I find that I have forgotten everything I learned and thought I hammered into my head the last time... I find reading AWS documentation on the subject almost unbearably tedious, so I need to go and re-read tutorials and re-watch videos. Coincidentally, this is what I am doing again this morning!

digitalsushi 4y ago

That said, this article cleared up a little bit of permission boundaries. It's now clearer to me that my organization is doing what the article speaks of, with cross-accounts and permission boundaries, and having the two-layer-admin clarified has not made my understanding worse. Good article.

jfengel 4y ago

That has been my experience as well. I don't understand it well enough to say that it's more complicated than it needs to be, but it's certainly clear that there is no obvious on-ramp. Everything starts locked down, and opening up anything requires figuring out which of numerous options gives you what you need without inviting the entire universe in. Usually, the best way to learn is by experimentation. But with security, your "experiments" might leave you exposed. Or at least, leave your system in some nonstandard state, making it even harder to figure out what the correct route was supposed to be. It's why I've been happy to use things like netlify. They may not scale, but at least it feels like I can get a project up without it becoming an ordeal of opening permissions. It's not my main line of work, and as you say, I imagine I would figure it out if I did it consistently for a bit. But every time I start a side project using AWS, IAM scares me off.

technion 4y ago
I would suggest azure has an approach that shows how iam can be a lot simpler. I can create a resource group, and make you a contributor on that group. You now have full permissions to servers, storage and anything else created under that group without me having to enumerate them. If I want to create a new blob store under that group, you already have access without me having to edit iam. I can still make granular permissions where suitable. Azure makes the path to having all console users require mfa much simpler too.
- vdm 4y ago
  Thanks for sharing this perspective. AWS IAM does have resource condition keys which allow matching resources by account, org, org path, and tag. Resources in a Cloudformation stack would be automatically tagged, for example. https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p...

InfoSecErik 4y ago

This diagram was pretty critical in helping me "get it": https://docs.aws.amazon.com/IAM/latest/UserGuide/images/PolicyEvaluationHorizontal111621.png https://docs.aws.amazon.com/IAM/latest/UserGuide/images/Poli...

digitalsushi 4y ago
Thank you for taking the time to link this. I appreciate it, this is indeed very helpful.

darraghenright 4y ago

I think you're being a little harsh on yourself, but I can emphatise. Every time I need to do something IAM related that's beyond the obvious, I find that I have forgotten everything I learned and thought I hammered into my head the last time... I find reading AWS documentation on the subject almost unbearably tedious, so I need to go and re-read tutorials and re-watch videos. Coincidentally, this is what I am doing again this morning!