3 ms·

>I'm also enjoying staying sane avoiding IAM. This sticks out to me. IAM isn't crazy, and having access controls in place is going to be the very first thing y

>I'm also enjoying staying sane avoiding IAM. This sticks out to me. IAM isn't crazy, and having access controls in place is going to be the very first thing you want to do when you bring someone else on board. Maybe you're not there yet, but it would be a wise time investment to understand how these work, to the point where they don't feel confusing.

fragmede 3y ago
For a lifestyle business that's never going to grow into needing enterprise offerings, IAM is overkill. Like K8 would be for HN or other simple web forum.
- Supply5411 3y ago
  I disagree. IAM is like having a house with doors that lock. It doesn't matter how big or small your house is, you're going to want the ability to restrict who can go where and do what. It's part of basic security. If they're not doing that, and their 1 server is talking to AWS resources, it means its using superadmin credentials. If that 1 server is compromised, can you see why that would be a bad idea?
  - syndicatedjelly 3y ago
    But does not using IAM mean that they are not doing anything to handle credentials securely?
    - theshrike79 3y ago
      To keep with the house analogy, not using IAM is like building your own locks for your house. It might be enough for now, but if you grow big enough to be a target it's very likely your home-spun lock won't stand up to professionals.
      - rovr138 3y ago
        I think it's figuring out where to put them or installing them yourself vs building the locks. Most things have accounts (database, servers). Are you using separate ones or a global admin?
      - fragmede 3y ago
        To use the house analogy, it's more like a shed vs a mansion. How many doors are there? How many different keys are there for them, and is there a master key? If you have a shed, there's only going to be one key, for the door. Maaaaaybe a key for the safe inside. If it's an exorbitant mansion with three kitchens and two garages, there's a key for the front door, a key for your bedroom, a key for the safe room, a key to the wine cellar, a key to the garage, a key to the IT closet, a key to the office, a key to the... you get the point. If it's only ever going to be a shed, there's no need for the infrastructure to support that many keys.
      - syndicatedjelly 3y ago
        Thanks, that makes sense. What does IAM offer that a stand-alone service like Keybase doesn’t? At what scale of project does it make sense to use one over another?
    - Supply5411 3y ago
      How do you secure AWS credentials on a compromised machine? Any solution that you build is going to be more complicated and less secure than IAM. In IAM, your workload/server can have an identity. The software running on the server is issued temporary credentials as needed, and only has access to resources linked to the role. How do you do this without identity and access management? Roll your own because IAM is too crazy?
esperent 3y ago
I'm not hugely familiar with IAM, but can't you get basically the same, for free, using Cloudflare Zero Trust or even Tailscale?
shrubble 3y ago
You can restrict different services to different users, or if using containers, give access based on which container. IAM is not the only way to have shared, controlled access.

fragmede 3y ago

For a lifestyle business that's never going to grow into needing enterprise offerings, IAM is overkill. Like K8 would be for HN or other simple web forum.

Supply5411 3y ago
I disagree. IAM is like having a house with doors that lock. It doesn't matter how big or small your house is, you're going to want the ability to restrict who can go where and do what. It's part of basic security. If they're not doing that, and their 1 server is talking to AWS resources, it means its using superadmin credentials. If that 1 server is compromised, can you see why that would be a bad idea?
- syndicatedjelly 3y ago
  But does not using IAM mean that they are not doing anything to handle credentials securely?
  - theshrike79 3y ago
    To keep with the house analogy, not using IAM is like building your own locks for your house. It might be enough for now, but if you grow big enough to be a target it's very likely your home-spun lock won't stand up to professionals.
    - rovr138 3y ago
      I think it's figuring out where to put them or installing them yourself vs building the locks. Most things have accounts (database, servers). Are you using separate ones or a global admin?
    - fragmede 3y ago
      To use the house analogy, it's more like a shed vs a mansion. How many doors are there? How many different keys are there for them, and is there a master key? If you have a shed, there's only going to be one key, for the door. Maaaaaybe a key for the safe inside. If it's an exorbitant mansion with three kitchens and two garages, there's a key for the front door, a key for your bedroom, a key for the safe room, a key to the wine cellar, a key to the garage, a key to the IT closet, a key to the office, a key to the... you get the point. If it's only ever going to be a shed, there's no need for the infrastructure to support that many keys.
    - syndicatedjelly 3y ago
      Thanks, that makes sense. What does IAM offer that a stand-alone service like Keybase doesn’t? At what scale of project does it make sense to use one over another?
  - Supply5411 3y ago
    How do you secure AWS credentials on a compromised machine? Any solution that you build is going to be more complicated and less secure than IAM. In IAM, your workload/server can have an identity. The software running on the server is issued temporary credentials as needed, and only has access to resources linked to the role. How do you do this without identity and access management? Roll your own because IAM is too crazy?

esperent 3y ago

I'm not hugely familiar with IAM, but can't you get basically the same, for free, using Cloudflare Zero Trust or even Tailscale?

shrubble 3y ago

You can restrict different services to different users, or if using containers, give access based on which container. IAM is not the only way to have shared, controlled access.