DanielSlauth
DanielSlauth on Hacker News
>
I'd like to challenge you on what seems to be the main claim behind why Slauth is a necessary product: "the amount of money that is being spent on tooling to scan for IAM misconfigurations in the cloud.
The quote you use got me to further research the market and speak to users of those toolings. From speaking to the users it was evident that the amount of misconfigurations being deployed wasn't being reduced.
I imagine users of cloud scanning tools would also use a pro-active tool like Slauth or any other shift-left tool that would aim at preventing as opposed to reacting.
Perhaps I should have emphasized better that indeed the LLM's are trustworthy by themselves and require several extra checks. These would be policy simulators, connecting to cloud environments and running checks in Dev/Staging.
Again, I understand the skepticism using LLM's but currently everything is done manually and it shows that doesn't work well. So using LLM's is a quick way to improve the current situation and hopefully we can further compliment it with checks and balances
I believe the minute you connect a Dev or staging environment to Slauth.io and we can run simulations and show divs we can offer pretty strong SLA's..
The open-source project is a CLI you can put into your CI/CD so i think a pretty neat workflow where there should be less friction considering DevOps/security don't need to ping-pong on permissions.
Thanks and let's see what Q will look like. I'm hoping the project will further evolve in integrating it in your CI/CD with PR's when commit requires IAM changes.
First of all its pretty awesome your permissions are very tight. You are definitely on the other side of the spectrum compared to the rest. I get it that there is a lot of skepticism because of people hyping LLM's so indeed for now we use it as Copilot and not the driver.
Hopefully you can agree though its pretty random that we are still manually creating IAM policies and need to get accustomed with the thousands of different permissions :)
Do you think humans are doing a better job? Research shows that 95% of the permissions granted to users aren't used which creates huge problems and is a reason for spending millions in security tools. Why not use Slauth and other checks such as policy simulators to get tightened policies pre-deployed
Posted by
DanielSlauth on Monday December 04, 2023 @08:10AM
from the self-post dept.
Hi HN, We're Daniel and Bruno and working on (https://slauth.io/). Slauth.io is a CLI to auto-generate secure IAM policies for AWS, and GCP (Azure in the next few days!). We enable development teams to speed up creating secure policies and reduce over-permissive policies being deployed to the cloud.Check out the video or give our open-source CLI a try with one of the sample repo's on...
Posted by
DanielSlauth on Tuesday June 20, 2023 @03:21AM
from the now-hiring dept.
Posted by
DanielSlauth on Monday June 05, 2023 @08:53AM
from the ask-hn dept.
Almost 6 months ago I wrote this post https://news.ycombinator.com/item?id=34038663 which was a big motivation to start building the IAM Policy Copilot.We conducted a lot of interviews and honestly were confused about the best place to start. How can we best ingest data in order to generate a “least-privilege” policy. We started with integrating with Github actions to intercept traffic and...
Posted by
DanielSlauth on Wednesday March 15, 2023 @08:01AM
from the now-hiring dept.
Nice! Will work on the pricing tiers and features.
Regardless, would love for you to test it out and we can agree on the above $150/mo for 200 policies :)
Thank you for the feedback!! We needed something to start of with but your arguments are very fair so we will have to change it.
Would you like to sign up for the Beta and give it a try? Would absolutely love your opinionated feedback :D
Also, how much would you pay? Could you give us some insights there.
We have found several "problems" that we think can be done better
1) CloudTrail requires to run for a duration of time before suggesting a policy which means long time until getting value. What do you do until the suggestion? Run a less secure policy?
2) CloudTrial actually doesn't log all events so we are using either AWS SDK metrics or a proxy to make sure we get all activity
3) Integrations with Terraform, Git repository in order to make it easy to use in day to day
4) Hopefully in the future we can extend to other cloud vendors :)
Thanks! Will have a look. Have you used it? If so, would love to learn what you liked and didn't like
Getting slower haha... HN is generating traffic but will have to ask Webflow what's going on lol
Thanks!! Looks really good. I hope we can contribute from a different angle by focussing on the creation of the policy and ideally expand beyond AWS :) Thanks for the heads up
Yes def! We wanted to quickly validate the need so started with AWS but if we get good traction we will expand to GCP next :) Feel free to share with AWS users so that we can get going :D
We eventually want to make this agnostic and have it work for all cloud vendors. Pretty complex to write policies if you are running multi-cloud!
Posted by
DanielSlauth on Sunday December 18, 2022 @10:39AM
from the show-hn dept.
Hey HN, we are Daniel and Tal, Co-founders of Slauth.io (https://slauth.io). Slauth auto-generates IAM policies in order to save engineering time and make your policies more secure.If you're an engineer, you probably know how tedious and error-prone it can be to manually write IAM policies. We surveyed over 70 engineers and found out that a majority are using or have used wildcards (*) in order...