4 ms·
It's a real problem. AWS IAM permissions are not human manageable anymore. The only way to get decent permissioning done is via an IaC abstraction layer that ca
by bilalq 3y ago
It's a real problem. AWS IAM permissions are not human manageable anymore. The only way to get decent permissioning done is via an IaC abstraction layer that can generate them for you based on declared needs. AWS CDK does a pretty decent job here at making it so you can just say `myTable.grantRead(myLambda)`. A lot of the higher level constructs take care of transitive permissions that are needed. Even then, there are cases where you need to make sure you don't just do `myBucket.grantRead(thing)` but also `myEncryptionKey.grantDecrypt(thing)`.
Doing fine-grained permissions correctly is hard.
- kevinslin 3y agoamen to that. working with cloud infrastructure is like working with 2020 machines using assembly. there is a large, and growing, disconnect between the power of the hardware and expressivity of the underlying language used to unlock it