4 ms·
But they are, that's kind of the whole point. You start with {"actions": ["s3:"], "resources": [""]} and graduate from there when ready.
by lijok 2y ago
But they are, that's kind of the whole point. You start with {"actions": ["s3:"], "resources": [""]} and graduate from there when ready.
- egorfine 2y agoThis could be a perfect 101 on IAM which I would strongly prefer never attending.
- lijok 2y agoHow else do you expect to manage permissions? Is there a better dsl design you have in mind?
- egorfine 2y agoWhat is better? I am pretty sure IAM is the best there is, no questions about that. Better for small teams? Sure: a login/password system with maybe optional restrictions on services and maybe "readonly" access and maybe with disabled aws console. Basically, something that was in AWS before the IAM madness came in.
- JackSlateur 2y agoBut you can do that with IAM, and quite easily too Create IAM user with access/secret keys are easy Assign the built-in ReadOnly policy, easy too, or any other built-in "generic" policy
- egorfine 2y agoYou are missing my point. Of course, it is possible with IAM because IAM is a top-tier ACL system. The point: I don't want to learn it.
- danielheath 2y agoIf my account has only got one thing in it, I don’t expect to manage permissions at all. “Everything has root” is fine when you are starting a new thing - what’s needed is tooling to start there and grow into fine grained permissions when you add a second thing.