3 ms·
There are no constraints on the allowed contents of an AWS IAM policy, and that’s too much power to give an author. I wish it were a capability-based system: wh
by erik_seaberg 4y ago
There are no constraints on the allowed contents of an AWS IAM policy, and that’s too much power to give an author. I wish it were a capability-based system: whatever privileges I may have, I can pass on some or all of those, but no more.
- hcazz 4y ago> whatever privileges I may have, I can pass on some or all of those, but no more. That's just a permission boundary in AWS. https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html https://docs.aws.amazon.com/IAM/latest/UserGuide/access_poli...
- Hikikomori 4y agoCreate a system to manage IAM roles.
- poxrud 4y agoYou can create constraints as the ones you describe using Organizations and SCPs(Service Control Policy)