IAM whatever you say IAM

Re:IAM whatever you say IAM by gbrindisi on Thursday November 05, 2020 @04:09PM (#25002001)

Regarding inventorization of assets: my team also did the same at Spotify last year for Google Cloud Platform. https://engineering.atspotify.com/2019/06/04/painting-a-pict...

At the time Cartography support for GCP was lacking, so we just ingested Cloud Asset Inventory data in neo4j.

If you are on GCP I highly suggest using CAI as a backbone for IAM security controls: hands down the best service on the platform for security teams.

[ Parent | on HN ]

Re:IAM whatever you say IAM by alexchantavy on Thursday November 05, 2020 @04:21PM (#25002107)

Thanks for sharing! We investigated using CAI last year in Cartography but decided against that and to be honest I can't quite remember why. It might have been something about required permissions, or it might have simply been me not understanding GCP well enough.

It might be time to revisit that decision now though: it would be neat to have your CAI ingestion logic in Cartography :-)

[ Parent | on HN ]

Re:IAM whatever you say IAM by gbrindisi on Thursday November 05, 2020 @04:39PM (#25002295)

Hey! I strongly suggest using CAI rather than the GCP apis, it simplify a lot the collection of data and you won’t hit a road block with quotas and hidden quotas.

Pulling data from the APIs won’t scale and it’s the exact reason why we migrated off Forseti (forsetisecurity.org) , which we helped build in the first place.

Feel free to ping me if you want more details, my contact is in my profile.

[ Parent | on HN ]