3 ms·
Yes You are diving into another topic: "fine-grained permissions" In my opinion, fine-grained permissions is a very good idea for application-attached role: y
by JackSlateur 2y ago
Yes
You are diving into another topic: "fine-grained permissions"
In my opinion, fine-grained permissions is a very good idea for application-attached role: your lambda can only do "this", your ec2 instance can only do "that". For humans, they are a mistake and shall be avoided.
- egorfine 2y agoI'd love for fine-grained permissions to be optional. Not an insurmountable barrier to the actual service. Like let me start the development first. I'll get to security later. I came here for object storage, don't force me to learn an incredibly complex auxiliary service.
- lijok 2y agoBut they are, that's kind of the whole point. You start with {"actions": ["s3:"], "resources": [""]} and graduate from there when ready.
- egorfine 2y agoThis could be a perfect 101 on IAM which I would strongly prefer never attending.
- lijok 2y agoHow else do you expect to manage permissions? Is there a better dsl design you have in mind?
- egorfine 2y agoWhat is better? I am pretty sure IAM is the best there is, no questions about that. Better for small teams? Sure: a login/password system with maybe optional restrictions on services and maybe "readonly" access and maybe with disabled aws console. Basically, something that was in AWS before the IAM madness came in.
- JackSlateur 2y agoBut you can do that with IAM, and quite easily too Create IAM user with access/secret keys are easy Assign the built-in ReadOnly policy, easy too, or any other built-in "generic" policy
- egorfine 2y agoYou are missing my point. Of course, it is possible with IAM because IAM is a top-tier ACL system. The point: I don't want to learn it.
- danielheath 2y agoIf my account has only got one thing in it, I don’t expect to manage permissions at all. “Everything has root” is fine when you are starting a new thing - what’s needed is tooling to start there and grow into fine grained permissions when you add a second thing.
- xenophonf 2y ago> Like let me start the development first. I'll get to security later. And that's why the world is full of crappy, insecure software. Security is ever an afterthought.
- egorfine 2y agoWholeheartedly agree with you. Not only it's an afterthought, it's a sinkhole for resources with zero apparent ROI. It's basically lives in backlog rent-free.
- icedchai 2y agoThey basically are optional. You can use wildcards in the action. (Nobody will go back and tighten them up though.)
- egorfine 2y agoThey aren't. To have wildcards I still have to go to IAM and learn how to create a wildcard policy.
- icedchai 2y agoBut you don't have to list each and every permission, which was my point. This is far easier than investigating what your app does, mapping it to permissions, missing some of them, and iterating...