News for hackers. Stuff that matters.

A comment on Show HN: Policy_sentry, an AWS IAM Least Privilege Policy Generator. Parent comment

Re:Show HN: Policy_sentry, an AWS IAM Least Privilege Policy... by kmcquade on Tuesday October 15, 2019 @05:32PM (#21264069)
In the Terraform use case, that is probably possible if you hack together an analysis of the JSON policy files generated by the Terraform module and then allow/warn/deny based on the results. Alternatively, you could run the IAM analysis portion of this tool after Terraform apply.

I should also mention that the IAM authoring aspect of this tool is more mature than the policy analysis feature.

In CI/CD, if you are using Terraform, I suggest using Open Policy Agent for blocking access to certain resources by evaluating a Terraform plan. I suppose it's also possible to use OPA to evaluate the JSON output of a policy_sentry YML file.

Hope this helps.

[ Parent | on HN ]
Re:Show HN: Policy_sentry, an AWS IAM Least Privilege Policy... by philsnow on Tuesday October 15, 2019 @06:29PM (#21264680)
https://www.openpolicyagent.org/docs/latest/terraform/ very neat, I hadn't seen opa used in this way before.
[ Parent | on HN ]
Re:Show HN: Policy_sentry, an AWS IAM Least Privilege Policy... by kmcquade on Tuesday October 15, 2019 @06:46PM (#21264840)
Oh yeah it's super powerful. And it's not vendor-dependent like Sentinel & TF Enterprise (although I really love TF Cloud).

Here's an example of using OPA + Conftest with Terraform that you might be interested in: https://github.com/kmcquade/conftest-terraform-multifolder-p...

[ Parent | on HN ]