Hacker News Reader

Comment by digitalsushi | Hacker News Reader

IAM has really made me aware of my limitations as a run of the mill engineer and has me worried that it's exposed the boundaries of how far I can really scale. I keep telling myself that if I could simply get a couple days, uninterrupted, to focus on it, take it in, reflect, that I could become comfortable with it. But it never happens.

View on HN

This diagram was pretty critical in helping me "get it": https://docs.aws.amazon.com/IAM/latest/UserGuide/images/Poli...

Thank you for taking the time to link this. I appreciate it, this is indeed very helpful.

That said, this article cleared up a little bit of permission boundaries. It's now clearer to me that my organization is doing what the article speaks of, with cross-accounts and permission boundaries, and having the two-layer-admin clarified has not made my understanding worse. Good article.

That has been my experience as well. I don't understand it well enough to say that it's more complicated than it needs to be, but it's certainly clear that there is no obvious on-ramp. Everything starts locked down, and opening up anything requires figuring out which of numerous options gives you what you need without inviting the entire universe in.

Usually, the best way to learn is by experimentation. But with security, your "experiments" might leave you exposed. Or at least, leave your system in some nonstandard state, making it even harder to figure out what the correct route was supposed to be.

It's why I've been happy to use things like netlify. They may not scale, but at least it feels like I can get a project up without it becoming an ordeal of opening permissions.

It's not my main line of work, and as you say, I imagine I would figure it out if I did it consistently for a bit. But every time I start a side project using AWS, IAM scares me off.

I would suggest azure has an approach that shows how iam can be a lot simpler. I can create a resource group, and make you a contributor on that group.

You now have full permissions to servers, storage and anything else created under that group without me having to enumerate them. If I want to create a new blob store under that group, you already have access without me having to edit iam. I can still make granular permissions where suitable.

Azure makes the path to having all console users require mfa much simpler too.

Thanks for sharing this perspective.

AWS IAM does have resource condition keys which allow matching resources by account, org, org path, and tag. Resources in a Cloudformation stack would be automatically tagged, for example.

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p...

I think you're being a little harsh on yourself, but I can emphatise.

Every time I need to do something IAM related that's beyond the obvious, I find that I have forgotten everything I learned and thought I hammered into my head the last time...

I find reading AWS documentation on the subject almost unbearably tedious, so I need to go and re-read tutorials and re-watch videos. Coincidentally, this is what I am doing again this morning!

Reply on news.ycombinator.com