3 ms·
> At another corporation, it can take several weeks to learn how to fill out the IAM role and permission boundaries to allow a new app to run - and a governance
by KronisLV 4y ago
> At another corporation, it can take several weeks to learn how to fill out the IAM role and permission boundaries to allow a new app to run - and a governance board has to review it and allow it.
You know, this I never quite understood - why not provide example repos that follow all of the best practices? After all, the majority of the apps will be quite similar in their architectures and technologies (at least in some enterprises, e.g. "a Java shop" or something like that), so surely one can create some templates or snippets to work with.
- easton 4y agoSpeaking directly to the AWS case since that's what this is about, the whole point of permission boundaries is to prevent the blast radius of your IAM policy from being too wide. Coupled with service control policies ("thou shalt not" at an account level), I wonder why you'd need a manual review of your IAM policies. Unless it's a "we didn't know you could do that! time to stiffen up our policies" meeting, which seems weird. Having templates is useful though so you know what you need to define for your policies inside your boundaries.
- AdrianB1 4y agoI am writing best practices for my department. Nobody else wants to do that, it does snot help the career and it eats up you own time from other projects that still need to be delivered. Managers don't care, they are not measured by that. I do it for my team and share with others, there is no other reason.