IAM is hard – Thoughts on $80M fine from the Capital One Breach

Re:IAM is hard – Thoughts on $80M fine from the Capital One ... by staticassertion on Saturday August 08, 2020 @05:23PM (#24095358)

That describes my own personal hell with iam, and it drove me to adopt aws-cdk.

aws-cdk is their infra-as-code product and it's extremely valuable for iam alone.

You can say things like: my_lambda.grantRead(s3_bucket)

And it figures out the least privileges necessary to make all of that work.

Plus it's real code, not some annoying DSL, which means you can easily abstract other iam permissions out. I have a fairly tight lambda policy that I reuse in all sorts of places, and it's as easy to use as the above snippet.

[ Parent | on HN ]

Re:IAM is hard – Thoughts on $80M fine from the Capital One ... by orf on Saturday August 08, 2020 @05:44PM (#24095498)

Cloudformation. Ewww.

[ Parent | on HN ]

Re:IAM is hard – Thoughts on $80M fine from the Capital One ... by staticassertion on Saturday August 08, 2020 @06:12PM (#24095663)

Sure, CF is garbage, I won't try to argue otherwise.

There's this though: https://www.hashicorp.com/blog/cdk-for-terraform-enabling-py...

[ Parent | on HN ]

Re:IAM is hard – Thoughts on $80M fine from the Capital One ... by zymhan on Saturday August 08, 2020 @10:22PM (#24096784)

Wonder what Pulumi will do to stay relevant now.

[ Parent | on HN ]

Re:IAM is hard – Thoughts on $80M fine from the Capital One ... by staticassertion on Saturday August 08, 2020 @11:36PM (#24097056)

Pulumi probably has a better story around multicloud, but yes, it does seem like it's going to be difficult to differentiate.

[ Parent | on HN ]