<story><title>IAM is hard – Thoughts on $80M fine from the Capital One Breach</title><url>https://twitter.com/kmcquade3/status/1291801858676228098</url></story><parent_chain><item><author>john-shaffer</author><text>Those problems seem to come from the separation of the IAM admin from the developer. I&amp;#x27;m coding a server now. My IAM roles are defined in a template, and I just add new permissions to the template as I need them. My code has the bare minimum permissions that it needs, and it doesn&amp;#x27;t seem at all onerous for the benefit it provides. So I think the problem is less &amp;quot;IAM is hard&amp;quot;, and more &amp;quot;coordination is hard&amp;quot;.&lt;p&gt;The one big exception I&amp;#x27;ve run into is that to launch a CloudFormation template, the role practically needs admin access. I&amp;#x27;m considering offloading the launch to a minimal Lambda function with the requisite (very broad) permissions. Does anyone have a better approach?</text></item></parent_chain><comment><author>jimbobimbo</author><text>My team approaches this problem by using separate identities with different access policies for doing different things. The identity can be an alternative user account (disconnected from the primary corp domain) or a service principal that does only limited set of things.&lt;p&gt;For example, an alternative user account with restricted time window for access is used to even get to performing infrastructure management tasks. Then each cluster has unique service principal attached to it for pulling containers and retrieving infra-related secrets, but cannot access application-related secrets. Applications that run on clusters use completely different managed identity which doesn&amp;#x27;t have access to infra-related secrets, but has access to application-related secrets. On top of that, wherever possible, we restrict access to secrets only to GET operations, so you need to know the name of the secret beforehand in order to access it. The latter is not always possible, but if it is possible, we use it.&lt;p&gt;We use a bunch of scripts that go on and create all necessary identities and set up security policies, which helps a lot with ensuring the process is fully repeatable and risks of user mistakes are mitigated.</text></comment>
<story><title>IAM is hard – Thoughts on $80M fine from the Capital One Breach</title><url>https://twitter.com/kmcquade3/status/1291801858676228098</url></story><parent_chain><item><author>john-shaffer</author><text>Those problems seem to come from the separation of the IAM admin from the developer. I&amp;#x27;m coding a server now. My IAM roles are defined in a template, and I just add new permissions to the template as I need them. My code has the bare minimum permissions that it needs, and it doesn&amp;#x27;t seem at all onerous for the benefit it provides. So I think the problem is less &amp;quot;IAM is hard&amp;quot;, and more &amp;quot;coordination is hard&amp;quot;.&lt;p&gt;The one big exception I&amp;#x27;ve run into is that to launch a CloudFormation template, the role practically needs admin access. I&amp;#x27;m considering offloading the launch to a minimal Lambda function with the requisite (very broad) permissions. Does anyone have a better approach?</text></item></parent_chain><comment><author>lovehashbrowns</author><text>I agree that &amp;quot;coordination is hard&amp;quot; is the root issue here. For things I develop, it&amp;#x27;s easier for me to specifically say what permissions the IAM roles need, and I can get them down to least privilege.&lt;p&gt;Then sometimes I need to onboard an application written in a language I don&amp;#x27;t know, and it&amp;#x27;s a beast of an application. I ask the developer what permissions it needs, and they say &amp;quot;I don&amp;#x27;t know&amp;quot; but give me a full admin role they know works. I&amp;#x27;d love to go through the whole process of determining what permissions it needs, except that I have deadlines, and they have deadlines, and our deadlines are visible to management, and I have additional projects that I need to finish, and my team is already too small. It&amp;#x27;s like the universe is just telling me to give the application full admin.</text></comment>