News for hackers. Stuff that matters.

A comment on Awsviz.dev simplifying AWS IAM policies. Parent comment

Re:Awsviz.dev simplifying AWS IAM policies by nprateem on Wednesday July 10, 2024 @05:52AM (#40925290)
Well, for a start, you could have a recorder that actually shows all the relevant permissions for a particular API call so users can work out what they should set permissions on (including interactions with SCPs and anything else that could affect a decision).
[ Parent | on HN ]
Re:Awsviz.dev simplifying AWS IAM policies by rad_gruchalski on Wednesday July 10, 2024 @06:46AM (#40925578)
You can easily get the first part of via the sdk https://cloudonaut.io/record-aws-api-calls-to-improve-iam-po....
[ Parent | on HN ]
Re:Awsviz.dev simplifying AWS IAM policies by Aeolun on Wednesday July 10, 2024 @12:32PM (#40928663)
You can actually set this up in your account. It’ll record all the permission your roles actually use (over a customizable period of time), so you can remove all others
[ Parent | on HN ]