4 ms·

AWS IAM Explained with a Parable

32 points by kevinslin 3y ago

bilalq 3y ago
It's a real problem. AWS IAM permissions are not human manageable anymore. The only way to get decent permissioning done is via an IaC abstraction layer that can generate them for you based on declared needs. AWS CDK does a pretty decent job here at making it so you can just say `myTable.grantRead(myLambda)`. A lot of the higher level constructs take care of transitive permissions that are needed. Even then, there are cases where you need to make sure you don't just do `myBucket.grantRead(thing)` but also `myEncryptionKey.grantDecrypt(thing)`. Doing fine-grained permissions correctly is hard.
- kevinslin 3y ago
  amen to that. working with cloud infrastructure is like working with 2020 machines using assembly. there is a large, and growing, disconnect between the power of the hardware and expressivity of the underlying language used to unlock it
anyoneamous 3y ago
IAM isn't easy, but I don't think there is any way to build such a powerful system without at least having the possibility for it to become ultra-complex. The challenge then becomes taming the complexity while still being "secure enough", i.e. as secure as possible without hindering your business purpose. This is where I take issue with many security specialists in the cloud ecosystem - every single one I have encountered has been good for nothing more than rattling off the best practices (which I already knew). The difficult part of security is understanding the trade-offs you are making, and assessing the risk - but the security people never seem to be intellectually equipped to help with that, only to dole out checklists.
- koromak 3y ago
  AWS should make it easy to know which permissions are needed. That is really the problem here. You should be able to dry-run a stack deployment, and get a response with every single permission needed at the finest granularity possible. Theres ugly work arounds that only work some of the time to do this. There should be a rock solid way instead.
  - belter 3y ago
    You do know you can create your IAM Policies from Cloutrail logs? "Generate policies based on access activity" - https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_generate-policy.html https://docs.aws.amazon.com/IAM/latest/UserGuide/access_poli... "IAM Access Analyzer makes it easier to implement least privilege permissions by generating IAM policies based on access activity" - https://aws.amazon.com/blogs/security/iam-access-analyzer-makes-it-easier-to-implement-least-privilege-permissions-by-generating-iam-policies-based-on-access-activity/ https://aws.amazon.com/blogs/security/iam-access-analyzer-ma...

32 points by kevinslin 3y ago

It's a real problem. AWS IAM permissions are not human manageable anymore. The only way to get decent permissioning done is via an IaC abstraction layer that can generate them for you based on declared needs. AWS CDK does a pretty decent job here at making it so you can just say `myTable.grantRead(myLambda)`. A lot of the higher level constructs take care of transitive permissions that are needed. Even then, there are cases where you need to make sure you don't just do `myBucket.grantRead(thing)` but also `myEncryptionKey.grantDecrypt(thing)`. Doing fine-grained permissions correctly is hard.

kevinslin 3y ago
amen to that. working with cloud infrastructure is like working with 2020 machines using assembly. there is a large, and growing, disconnect between the power of the hardware and expressivity of the underlying language used to unlock it

anyoneamous 3y ago

IAM isn't easy, but I don't think there is any way to build such a powerful system without at least having the possibility for it to become ultra-complex. The challenge then becomes taming the complexity while still being "secure enough", i.e. as secure as possible without hindering your business purpose. This is where I take issue with many security specialists in the cloud ecosystem - every single one I have encountered has been good for nothing more than rattling off the best practices (which I already knew). The difficult part of security is understanding the trade-offs you are making, and assessing the risk - but the security people never seem to be intellectually equipped to help with that, only to dole out checklists.

koromak 3y ago
AWS should make it easy to know which permissions are needed. That is really the problem here. You should be able to dry-run a stack deployment, and get a response with every single permission needed at the finest granularity possible. Theres ugly work arounds that only work some of the time to do this. There should be a rock solid way instead.
- belter 3y ago
  You do know you can create your IAM Policies from Cloutrail logs? "Generate policies based on access activity" - https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_generate-policy.html https://docs.aws.amazon.com/IAM/latest/UserGuide/access_poli... "IAM Access Analyzer makes it easier to implement least privilege permissions by generating IAM policies based on access activity" - https://aws.amazon.com/blogs/security/iam-access-analyzer-makes-it-easier-to-implement-least-privilege-permissions-by-generating-iam-policies-based-on-access-activity/ https://aws.amazon.com/blogs/security/iam-access-analyzer-ma...