Policy_sentry on HackerShow

Dev tools

iam policy generator

SHOW HN2019

An AWS IAM Least Privilege Policy Generator

How HN reacted

Policy_sentry

Curious

Mostly questions and neutral comments

3 positive, 6 neutral or mixed, 0 critical. Score +0.18

LikedUseful gap-filling tool for least-privilege AWS policies

ObjectedPolicy analysis from CloudTrail is less accurate than the authoring feature

Summaries made by AI from the thread.

Shown by kmcquade on Oct 15, 2019. Click the card to turn it over.

97points

35comments

#494of 2,195 in 2019

Top 23%of 2019 by points

How HN took it

CuriousMostly questions and neutral comments

3 positive, 5 neutral or asking, 1 mixed, 0 critical, out of 9 comments about the project. Thread score +0.17.

Idea: 1 for, 0 against

Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.

positive neutral or mixed critical about another commenter or something else the maker

Generate IAM policies from CloudTrail logs
From 2 comments
- Related, I've been wondering if there's a tool that will generate a least-privilege policy out of an existing set of AWS CloudTrail records. It would be wonderful if I could run…
  bashinator on HN
- Regarding your point on the API logs - there are some blunders on AWS's part that make "policy suggestion" difficult. Behind the scenes right now, is still AWS figuring out what…
  kmcquade on HN
Block creation of policies with specific permissions in CI/CD
From 1 comment
- Is there any way to block the creation of policies containing specific permissions or resources? I know this can be trivially circumvented but if this tool is used in ci/cd it…
  vageli on HN
Clearer README with YAML examples
From 1 comment
- I completely understand (and have had) the problem, but I don't understand the solution that this offers? Or rather, I didn't without going Readme > Wiki > User Guide > something…
  OJFord on HN

How does it differ from AWS's aws-iam-generator
From 1 comment
- Neat project. How does it differ from `aws-iam-generator` released by AWS themselves? https://github.com/awslabs/aws-iam-generator
  bloblaw on HN
Does AWS CDK already solve this
From 1 comment
- I have a question, I recently had the opportunity to use AWS CDK (https://docs.aws.amazon.com/cdk/latest/guide/home.html) for a project. It seemed to me that CDK automatically…
  kevinsundar on HN

trailscraper
From 1 comment
- I believe trailscraper (https://github.com/flosell/trailscraper) does this. See `trailscraper generate`.
  thefrozenone on HN
cloudtracker
From 1 comment
- It does, but some disclaimers: 1. The generated policies have Resources set to all, not to a specific resource ARN 2. It downloads all of the CloudTrail logs. This takes a while.…
  kmcquade on HN
aws-iam-generator
From 1 comment
- Neat project. How does it differ from `aws-iam-generator` released by AWS themselves? https://github.com/awslabs/aws-iam-generator
  bloblaw on HN
Netflix Aardvark and Repokid
From 1 comment
- > and there's no automated tool that will automagically sense the AWS API calls that you perform and then write them for you in a least-privilege manner. Netflix released one two…
  jedberg on HN
AWS IAM Access Advisor
From 1 comment
- IAM also offers some built-in help for the removal part, by listing which services were accessed recently:…
  rzzzt on HN
Open Policy Agent
From 1 comment
- In the Terraform use case, that is probably possible if you hack together an analysis of the JSON policy files generated by the Terraform module and then allow/warn/deny based on…
  kmcquade on HN
HashiCorp Sentinel
From 1 comment
- Hashicorp has a tool/framework for this, Sentinel https://www.hashicorp.com/sentinel/ I haven't used it in production. It uses an even-more-baroque syntax than terraform's HCL…
  philsnow on HN