AWS has an automated reasoning group working on tools to help answer the high level questions about complicated policy configurations. [0] has been submitted four times to Hacker News, and received a total of 4 points and 0 comments.
[0] https://aws.amazon.com/blogs/security/protect-sensitive-data...
I too have been wondering the same. Does anyone else see a need for some external service that examines resources/permissions and give a clear picture and ongoing monitoring for changes? Are there any services that already do this well?
Amazon makes one https://aws.amazon.com/config/
Re:Unbundling AWS
by satanspastaroll on Monday December 02, 2019 @06:15AM
(#21681487)
What I'd like to see is larger space for custom rules. You can't have a single policy that defines a whitelist of functions you can do on an EC2 instance per user.
IAM and security management are the worst parts of AWS. It's complex an unintuitive. I always second guess my choices, wondering if I've left a gaping security hole somewhere.