Show HN: Policy_sentry, an AWS IAM Least Privilege Policy Generator

Re:Show HN: Policy_sentry, an AWS IAM Least Privilege Policy... by kevinsundar on Tuesday October 15, 2019 @05:42PM (#21264193)

I have a question, I recently had the opportunity to use AWS CDK (https://docs.aws.amazon.com/cdk/latest/guide/home.html) for a project. It seemed to me that CDK automatically does this to a certain degree and if CDK is the future for AWS infrastructure provisioning, this issue should organically go away. Anyone have any input?

[ Parent | on HN ]

Re:Show HN: Policy_sentry, an AWS IAM Least Privilege Policy... by k__ on Tuesday October 15, 2019 @06:51PM (#21264885)

I don't know if it's really the future, but at least it's an alternative.

Some people claim it's the wrong way, because it's another abstraction between a CFN-template and the CFN-engine (more moving parts, etc) and using a markup language that restricts you a bit, makes things more manageable.

[ Parent | on HN ]

Re:Show HN: Policy_sentry, an AWS IAM Least Privilege Policy... by kmcquade on Tuesday October 15, 2019 @05:48PM (#21264265)

I haven't used the AWS CDK before. I'm more of a Terraform guy. But at a glance, I don't think it solves the issue with access levels and resource ARNs. You can still create IAM policies that have s3:wildcard, or `service:someaction` against wildcard resources.

Essentially: Even when Infrastructure as Code exists, IAC developers can still make security mistakes. Our goal with this tool was to automate the process (it is way faster to build policies with this), and by default, restrict actions according to resource ARNs. I haven't seen any other tool do that to this degree, although I would be pleasantly surprised to learn about any that do.

Edit: Not sure why HN is blocking out the wildcard character.

[ Parent | on HN ]

Re:Show HN: Policy_sentry, an AWS IAM Least Privilege Policy... by crucialfelix on Wednesday October 16, 2019 @02:01AM (#21267492)

It does make it easier to create and change policies, and this increases your development velocity and hence the chance that youll dedicate enough time to security.

Some of the higher level constructs apply smart rules. Eg adding a load balancer target adds restricted access rules.

It's still hard to know what's been created and how everything is connected.

I made a graph visualization tool that live updates from a Cloudformation file. It solved all my visibility and understanding issues. I plan to release it soon.

[ Parent | on HN ]