AWS IAM having issues yet again

Re:AWS IAM having issues yet again by dividuum on Thursday October 01, 2020 @05:49PM (#24656498)

Maybe a stupid question, but isn't IAM related to almost any API access to AWS as it's used for authorization and authentication through a combination of identities and policies? Or does this outage only affect the meta level being access to IAM itself through its own API?

[ Parent | on HN ]

Re:AWS IAM having issues yet again by sofal on Thursday October 01, 2020 @06:14PM (#24656719)

There are 3 basic ways in which you might see an IAM/Identity related issue:

1. Control plane problems - these will manifest as latency or errors when calling the IAM service itself to make updates/additions/deletions of users/roles/policies/groups/etc. This is the most likely scenario if the dashboard names "IAM" specifically as the issue.

2. Propagation problems - problems with propagation will manifest as delays in seeing your control plane (IAM) actions reflected in the dataplane. For example, if you remove a user, but the user is still able to authenticate to AWS services for a lengthy period of time.

3. Dataplane problems - this will be problems with authentication or authorization to any and all AWS services. A widespread problem with authentication is less likely, but extremely bad, and will probably not be categorized in the dashboard as a problem only with IAM, since "IAM" is technically the name of the control plane.

[ Parent | on HN ]

Re:AWS IAM having issues yet again by mcqueenjordan on Thursday October 01, 2020 @06:22PM (#24656796)

[Disclaimer: I'm speaking as an engineer personally, not for any company.]

My understanding is that authz/authn flows have not been affected. If authz/authn flows (which occur on every API call) were affected, I suspect the effect would be far more noticeable.

[ Parent | on HN ]

Re:AWS IAM having issues yet again by birdyrooster on Thursday October 01, 2020 @07:31PM (#24657285)

IAM is probably decentralized using trusted CA certificates to allow other AWS services to validate tokens previously created by IAM when it wasn't down. Yeah if you want new tokens you are just out of luck, but existing ones will keep working.

[ Parent | on HN ]

Re:AWS IAM having issues yet again by acdha on Thursday October 01, 2020 @05:53PM (#24656530)

The last time this happened I saw errors changing IAM entities but not using them or getting STS tokens, which made sense if it was related to propagating changes.

[ Parent | on HN ]

Re:AWS IAM having issues yet again by ManWith2Plans on Thursday October 01, 2020 @05:57PM (#24656571)

This is what I experienced this time too. Still impacts development significantly if you use a tool like terraform.

[ Parent | on HN ]

Re:AWS IAM having issues yet again by acdha on Thursday October 01, 2020 @07:10PM (#24657140)

Definitely – just changes it from “critical - the world is on fire” to “major”.

[ Parent | on HN ]