AWS Elasticsearch: a fundamentally-flawed offering

Re:AWS Elasticsearch: a fundamentally-flawed offering by ajb on Friday October 11, 2019 @05:08PM (#21228488)

That's the right way of doing it IMO. I've got a PoC script which finds the minimum subset of permissions to allow some action: https://github.com/KanoComputing/aws-tools/blob/master/bin/a...

Haven't had time to productise it yet. I think doing this makes you quite a bit safer, because it means you don't end up giving up and allowing more than you need. However, you still need to understand which actions shouldn't be allowed, so it's not the whole solution.

[ Parent | on HN ]

Re:AWS Elasticsearch: a fundamentally-flawed offering by ethbro on Friday October 11, 2019 @07:40PM (#21229396)

That's awesome!

That said, if a customer has to fuzz a platform's settings to discern their effect, the UX definitely needs work.

[ Parent | on HN ]

Re:AWS Elasticsearch: a fundamentally-flawed offering by all_usernames on Friday October 11, 2019 @07:21PM (#21229304)

Netflix open sourced a similar tool that watches API calls for a Role and then suggests minimum privilege changes to the attached policy document: https://github.com/Netflix/repokid

[ Parent | on HN ]

Re:AWS Elasticsearch: a fundamentally-flawed offering by ajb on Saturday October 12, 2019 @06:41PM (#21236872)

That's interesting. That can only work if there's some way of introspecting permissions - which I didn't realise existed. Mine works by experiment. I wonder how fine grained their way is.

[ Parent | on HN ]

Re:AWS Elasticsearch: a fundamentally-flawed offering by bifrost on Saturday October 12, 2019 @11:50PM (#21238242)

Ooooh I gotta check that out!

[ Parent | on HN ]