News for hackers. Stuff that matters.

A comment on IAM is hard – Thoughts on $80M fine from the Capital One Breach. Parent comment

Re:IAM is hard – Thoughts on $80M fine from the Capital One ... by devonkim on Saturday August 08, 2020 @12:46PM (#24093034)
Years ago I wrote a program to let various services run their course, query Cloudtrail for successful calls madero different AWS services, and attempt to find a minimal set of IAM permissions (not applicable for S3 at the time). The idea was to run an exhaustive test suite with expected allowed actions only and deny anything else. I believe AWS has a similar tool now for IAM but it’s not a problem that’ll be resolved satisfactorily for everyone given the combinatorics of IAM possible. Lateral movement in IAM roles and credentials is tough and even today not every action that IMO should be flagged is reported (IAM role assumption failures across accounts is silent when I checked early last year).
[ Parent | on HN ]
Re:IAM is hard – Thoughts on $80M fine from the Capital One ... by kmcquade on Saturday August 08, 2020 @01:15PM (#24093268)
Did you open source it? If not, you definitely should.
[ Parent | on HN ]
Re:IAM is hard – Thoughts on $80M fine from the Capital One ... by paulz_ on Saturday August 08, 2020 @03:39PM (#24094509)
Someone has actually been working on a project like this. While not 100% complete it's the best working one I know of. Can definitely relate to the problem being described here, especially when writing IAM policies for terraform deployments.

https://github.com/flosell/trailscraper

[ Parent | on HN ]
Re:IAM is hard – Thoughts on $80M fine from the Capital One ... by devonkim on Saturday August 08, 2020 @02:44PM (#24094052)
Probably can’t be open sourced given IP under contracts but I could try to re-write it. There’s some new services in IAM that could be leveraged to make it more accurate and cheaper to use, too.
[ Parent | on HN ]
Re:IAM is hard – Thoughts on $80M fine from the Capital One ... by jsperx on Saturday August 08, 2020 @03:04PM (#24094178)
Thank you for putting this idea in my head! I’ve been trying to get better at expressing infrastructure as code, and one of the big blockers has been how adding new services to e.g. Terraform is tough when you don’t know all their permissions they need (see also https://github.com/hashicorp/terraform/issues/2834 for example).

Using a test AWS environment to stage and then checking CloudTrail to see what was actually called would be a step forward. Having software to extract it would be even better.

[ Parent | on HN ]