Show HN: Policy_sentry, an AWS IAM Least Privilege Policy Generator

Re:Show HN: Policy_sentry, an AWS IAM Least Privilege Policy... by bloblaw on Tuesday October 15, 2019 @05:48PM (#21264258)

Neat project.

How does it differ from `aws-iam-generator` released by AWS themselves?

https://github.com/awslabs/aws-iam-generator

[ Parent | on HN ]

Re:Show HN: Policy_sentry, an AWS IAM Least Privilege Policy... by kmcquade on Tuesday October 15, 2019 @05:56PM (#21264358)

Thanks!

aws-iam-generator still requires you to write the actual policy templates from scratch, and then they allow you to re-use those policy templates.

Consider the JSON under this area of their README: https://github.com/awslabs/aws-iam-generator#managed-policie...

It's essentially a method for managing their policies as code - but it doesn't make those policies restricted to certain resources, unless you configure it that way. Using `policy_sentry --write-policy --crud`, you have to supply a file with resource ARNs, and it will write the policy for you, rather than supplying a policy file, and hoping the ARNs fit that use case.

Does that make sense?

[ Parent | on HN ]