kmcquade

7 ms·

31.
by kmcquade 7y ago
Updated.
32.
by kmcquade 7y ago
Good feedback - I will put that stuff in the README. Was thinking about doing that earlier today. Thanks!
33.
by kmcquade 7y ago
Yep. Sentinel is for paid customers only, so it has to go through Terraform enterprise.
34.
by kmcquade 7y ago
Oh yeah it's super powerful. And it's not vendor-dependent like Sentinel & TF Enterprise (although I really love TF Cloud). Here's an example of using OPA + Conftest with Terraform that you might be interested in: https:
35.
by kmcquade 7y ago
Unfortunately IAM Access Advisor only points to use of services (ex: S3-wide, EC2-wide), not use of IAM Actions. So it's useful, but it has serious limitations. I am hoping that they provide more granular results in the future.
36.
by kmcquade 7y ago
Thanks! aws-iam-generator still requires you to write the actual policy templates from scratch, and then they allow you to re-use those policy templates. Consider the JSON under this area of their README: https://github.com/
37.
by kmcquade 7y ago
+1 on the Service control policies
38.
by kmcquade 7y ago
I haven't used the AWS CDK before. I'm more of a Terraform guy. But at a glance, I don't think it solves the issue with access levels and resource ARNs. You can still create IAM policies that have s3:wildcard, or `service:som
39.
by kmcquade 7y ago
Regarding your point on the API logs - there are some blunders on AWS's part that make "policy suggestion" difficult. Behind the scenes right now, is still AWS figuring out what IAM privileges actually correlate to what actio
40.
by kmcquade 7y ago
In the Terraform use case, that is probably possible if you hack together an analysis of the JSON policy files generated by the Terraform module and then allow/warn/deny based on the results. Alternatively, you could run the IAM a
41.
Show HN: Policy_sentry, an AWS IAM Least Privilege Policy Generator(github.com)
97 points by kmcquade 7y ago|35 comments