7 ms·

I would suggest azure has an approach that shows how iam can be a lot simpler. I can create a resource group, and make you a contributor on that group. You now

I would suggest azure has an approach that shows how iam can be a lot simpler. I can create a resource group, and make you a contributor on that group. You now have full permissions to servers, storage and anything else created under that group without me having to enumerate them. If I want to create a new blob store under that group, you already have access without me having to edit iam. I can still make granular permissions where suitable. Azure makes the path to having all console users require mfa much simpler too.

vdm 4y ago
Thanks for sharing this perspective. AWS IAM does have resource condition keys which allow matching resources by account, org, org path, and tag. Resources in a Cloudformation stack would be automatically tagged, for example. https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p...