4 ms·
AWS should make it easy to know which permissions are needed. That is really the problem here. You should be able to dry-run a stack deployment, and get a resp
by koromak 3y ago
AWS should make it easy to know which permissions are needed. That is really the problem here.
You should be able to dry-run a stack deployment, and get a response with every single permission needed at the finest granularity possible.
Theres ugly work arounds that only work some of the time to do this. There should be a rock solid way instead.
- belter 3y agoYou do know you can create your IAM Policies from Cloutrail logs? "Generate policies based on access activity" - https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_generate-policy.html https://docs.aws.amazon.com/IAM/latest/UserGuide/access_poli... "IAM Access Analyzer makes it easier to implement least privilege permissions by generating IAM policies based on access activity" - https://aws.amazon.com/blogs/security/iam-access-analyzer-makes-it-easier-to-implement-least-privilege-permissions-by-generating-iam-policies-based-on-access-activity/ https://aws.amazon.com/blogs/security/iam-access-analyzer-ma...