News for hackers. Stuff that matters.

A comment on AWS Announces the General Availability of AWS CloudFormation Hooks. Parent comment

Re:AWS Announces the General Availability of AWS CloudFormat... by jedberg on Saturday February 12, 2022 @02:22AM (#30310671)
Agreed, but you can make it manageable if you do it a lot. First give your CF runner full permissions. Then once you have your CF done and working, take away all permissions from your CF runner. Then add them back one by one as it fails.

You can even build a script to run it, check the errors, update IAM, and then run it again.

Eventually you'll have a set of IAM least privilege rules. It's a pain but it's secure.

[ Parent | on HN ]
Re:AWS Announces the General Availability of AWS CloudFormat... by EE84M3i on Saturday February 12, 2022 @03:10AM (#30310908)
Do the actions from CloudFormation not show up in CloudTrail?
[ Parent | on HN ]
Re:AWS Announces the General Availability of AWS CloudFormat... by w1nt3rmut3 on Saturday February 12, 2022 @03:40AM (#30311078)
They do and there is even a button in iam to do just that. Also exposed as api to regernate the policy based on usage.
[ Parent | on HN ]
Re:AWS Announces the General Availability of AWS CloudFormat... by balls187 on Saturday February 12, 2022 @02:59PM (#30315784)
Would you mind pointing me to a doc about regenerating policies based on usage?

The pain I'm dealing with is having to look at the event logs to determine which CF task failed due to permission, then add that to the CF policy.

[ Parent | on HN ]
Re:AWS Announces the General Availability of AWS CloudFormat... by orf on Saturday February 12, 2022 @06:06PM (#30317281)
> Would you mind pointing me to a doc about regenerating policies based on usage?

First result in Google gift “generate IAM policies from usage”

https://docs.aws.amazon.com/IAM/latest/UserGuide/access_poli...

[ Parent | on HN ]