3 ms·
Giving admin access to a production AWS account is kinda scary, have you thought about curating the permissions to make them less permissive?
by nm3 3y ago
Giving admin access to a production AWS account is kinda scary, have you thought about curating the permissions to make them less permissive?
- nickzelei 3y agoI agree. The role that Nucleus asks you to create does not ask for the AdministratorAccess policy. Instead, it calls out the specific product areas that it accesses. We also have a description of each one and why we need it in our docs. https://docs.nucleuscloud.com/home/concepts/permissions-overview#permissions-policy https://docs.nucleuscloud.com/home/concepts/permissions-over... However, we can definitely be more detailed and call out specific actions that we need in those areas. That still leaves us with IAM though. I think we can still do better here to further limit IAM, but as of right now we can still do a lot if we have full access to the IAM featureset. It's something we're working on improving, but for now, I always suggest folks turn on auditing in their AWS accounts to keep ontop of anything that is happening.