Manage AWS costs on non-production environments

Re:Manage AWS costs on non-production environments by boredgamer2 on Thursday May 14, 2020 @08:58AM (#23178894)

Woah, No! Stop. Their homepage claims "Grant us least privilege permissions to your AWS account(s)."

But then their docs [1] give you this admin policy to use.

  {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        }
    ]

}

[1] https://microtica.atlassian.net/servicedesk/customer/portal/...

[ Parent | on HN ]

Re:Manage AWS costs on non-production environments by scarface74 on Thursday May 14, 2020 @10:14AM (#23179765)

WTF!

And this is the first time I’ve ever said that on HN in four years. I’m suppose to give a third party full access to my infrastructure with a cross account role??

This isn’t even hosted on your own account? But even then with full access they could do anything.

Any company that would tell you to do something this crazy even if they don’t have any bad intent, is far too immature to trust with my infrastructure.

[ Parent | on HN ]

Re:Manage AWS costs on non-production environments by chrisweekly on Thursday May 14, 2020 @09:02AM (#23178941)

whoa. good catch!

[ Parent | on HN ]

Re:Manage AWS costs on non-production environments by radedespodovski on Thursday May 14, 2020 @09:19AM (#23179125)

Since with Microtica you could provision any kind of AWS service the policy mentioned in the documentation is left to be more open so you can tryout fast and then when you figure out what you need the access could be reduced.

Ultimately, the user has the complete control over what access he will give to Microtica.

Since this policy was primarily intended for DevOps module, and Cost Optimizer needs only a subset of those permissions we will update the documentation to avoid the confusion.

[ Parent | on HN ]

Re:Manage AWS costs on non-production environments by a012 on Thursday May 14, 2020 @09:31AM (#23179248)

No, please just no. Don't give anybody outside of your org full admin permissions. Putting a bad example is bad, and also show their incompetences. At least they can put a red giant box to warn people, not expecting everybody know not to do it.

[ Parent | on HN ]

Re:Manage AWS costs on non-production environments by scarface74 on Thursday May 14, 2020 @10:35AM (#23180034)

I avoid giving myself admin permissions except when absolutely necessary. I created a “read only role” with no permissions and then started adding permissions to it as I run into issues.

I log into our management account and switch to the read only role for our prod account. If I have to switch to admin role I have the toolbar display as red.

If I’m that paranoid about me making a mistake, why would I trust a third party with those rights?

[ Parent | on HN ]

Re:Manage AWS costs on non-production environments by radedespodovski on Thursday May 14, 2020 @11:27AM (#23180681)

Just realized that the example with CLI in the docs have the right policy with least privileges. Somehow the part with the full access was overlooked. We just updated the documentation.

I completely agree with your approach, we also encourage our users to start with the base permissions and then give more when necessary. Even more, to give an access only on resources provisioned by our system. As we automatically tag all resources, using IAM policy conditions this could be easily done. The control is always on the user's side.

[ Parent | on HN ]