Re:AWS IAM Policies in a Nutshell
by vacri on Thursday March 23, 2017 @04:57PM
(#13944188)
> I've found IAM's power impressive but ultimately complex
Honestly, as a not-a-security-guy, I can count on the fingers of one hand the number of times I've had to learn something around security and it's been easy.
> separate AWS accounts for each environment may well be the best way to do this
A thousand times yes. There is so much to do in IAM, that it's just easier to let the devs have access to a 'test' account, and keep the 'prod' account out of their mitts.
Honestly, as a not-a-security-guy, I can count on the fingers of one hand the number of times I've had to learn something around security and it's been easy.
> separate AWS accounts for each environment may well be the best way to do this
A thousand times yes. There is so much to do in IAM, that it's just easier to let the devs have access to a 'test' account, and keep the 'prod' account out of their mitts.