[{"data":1,"prerenderedAt":293},["ShallowReactive",2],{"project-21262954":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":27,"sentiment":28,"stance_mix":29,"scored_comments":34,"aspects":35,"strip":38,"post_text":39,"what":40,"said":66,"maker_in_thread":165,"shape":176,"grid":180,"attempts":257,"same_week":258,"maker_shows":30,"maker_hidden":285,"reader_version":286,"card":287},"21262954","Policy_sentry","An AWS IAM Least Privilege Policy Generator","title","Show HN: Policy_sentry, an AWS IAM Least Privilege Policy Generator","https:\u002F\u002Fgithub.com\u002Fsalesforce\u002Fpolicy_sentry","github.com","kmcquade",1571169340,2019,97,35,494,2195,23,"notable","dev_tools","iam policy generator","cli",[24,25,21,26],"aws iam","least privilege","aws security","curious",0.175,{"positive":30,"neutral":31,"mixed":32,"critical":33},3,5,1,0,9,{"idea":36,"docs":37},{"positive":32,"critical":33},{"positive":33,"critical":33},[30,33,33,33,31,33,30,33,33,33,33,33,30,33,30,33,33,33,33,30,33,33,33,33,33,33,33,31,31,33,33,33,30,33,33],null,{"problem":41,"audience":39,"pricing":39,"motivation":51,"time_to_build":39,"stack":55,"openness":63,"stage":64,"team_size":65},{"value":42,"source":43,"evidence":44},"Writing least-privilege AWS IAM policies by hand is slow and error-prone, and policies often use wildcards","maker",[45,48],{"id":46,"by":11,"text":47},"21264265","I haven't used the AWS CDK before. I'm more of a Terraform guy. But at a glance, I don't think it solves the issue with access levels and resource ARNs. You can still create IAM…",{"id":49,"by":11,"text":50},"21264358","Thanks! aws-iam-generator still requires you to write the actual policy templates from scratch, and then they allow you to re-use those policy templates. Consider the JSON under…",{"value":52,"source":43,"evidence":53},"Automate least-privilege IAM policy writing, since building them manually is slow and mistakes happen even with infrastructure as code",[54],{"id":46,"by":11,"text":47},[56],{"value":57,"source":43,"evidence":58},"Terraform",[59,60],{"id":46,"by":11,"text":47},{"id":61,"by":11,"text":62},"21264069","In the Terraform use case, that is probably possible if you hack together an analysis of the JSON policy files generated by the Terraform module and then allow\u002Fwarn\u002Fdeny based on…","open_source","launched","team",{"praise":67,"objections":79,"requests":85,"questions":109,"alternatives":124},[68],{"value":69,"source":70,"evidence":71},"Useful gap-filling tool for least-privilege AWS policies","commenter",[72,76],{"id":73,"by":74,"text":75},"21273810","bashinator","Thank you! I'm glad to see there's progress on this. I've been holding off putting the infrastructure automation into CI\u002FCD, due to the incredible amount of work it would take to…",{"id":77,"by":11,"text":78},"21266472","It does, but some disclaimers: 1. The generated policies have Resources set to all, not to a specific resource ARN 2. It downloads all of the CloudTrail logs. This takes a while.…",[80],{"value":81,"source":43,"evidence":82},"Policy analysis from CloudTrail is less accurate than the authoring feature",[83,84],{"id":77,"by":11,"text":78},{"id":61,"by":11,"text":62},[86,95,102],{"value":87,"source":70,"evidence":88},"Generate IAM policies from CloudTrail logs",[89,92],{"id":90,"by":74,"text":91},"21264963","Related, I've been wondering if there's a tool that will generate a least-privilege policy out of an existing set of AWS CloudTrail records. It would be wonderful if I could run…",{"id":93,"by":11,"text":94},"21264166","Regarding your point on the API logs - there are some blunders on AWS's part that make \"policy suggestion\" difficult. Behind the scenes right now, is still AWS figuring out what…",{"value":96,"source":70,"evidence":97},"Block creation of policies with specific permissions in CI\u002FCD",[98],{"id":99,"by":100,"text":101},"21263951","vageli","Is there any way to block the creation of policies containing specific permissions or resources? I know this can be trivially circumvented but if this tool is used in ci\u002Fcd it…",{"value":103,"source":70,"evidence":104},"Clearer README with YAML examples",[105],{"id":106,"by":107,"text":108},"21264949","OJFord","I completely understand (and have had) the problem, but I don't understand the solution that this offers? Or rather, I didn't without going Readme > Wiki > User Guide > something…",[110,117],{"value":111,"source":70,"evidence":112},"How does it differ from AWS's aws-iam-generator",[113],{"id":114,"by":115,"text":116},"21264258","bloblaw","Neat project. How does it differ from `aws-iam-generator` released by AWS themselves? https:\u002F\u002Fgithub.com\u002Fawslabs\u002Faws-iam-generator",{"value":118,"source":70,"evidence":119},"Does AWS CDK already solve this",[120],{"id":121,"by":122,"text":123},"21264193","kevinsundar","I have a question, I recently had the opportunity to use AWS CDK (https:\u002F\u002Fdocs.aws.amazon.com\u002Fcdk\u002Flatest\u002Fguide\u002Fhome.html) for a project. It seemed to me that CDK automatically…",[125,132,136,140,147,154,158],{"value":126,"source":70,"evidence":127},"trailscraper",[128],{"id":129,"by":130,"text":131},"21266011","thefrozenone","I believe trailscraper (https:\u002F\u002Fgithub.com\u002Fflosell\u002Ftrailscraper) does this. See `trailscraper generate`.",{"value":133,"source":43,"evidence":134},"cloudtracker",[135],{"id":77,"by":11,"text":78},{"value":137,"source":70,"evidence":138},"aws-iam-generator",[139],{"id":114,"by":115,"text":116},{"value":141,"source":70,"evidence":142},"Netflix Aardvark and Repokid",[143],{"id":144,"by":145,"text":146},"21267823","jedberg","> and there's no automated tool that will automagically sense the AWS API calls that you perform and then write them for you in a least-privilege manner. Netflix released one two…",{"value":148,"source":70,"evidence":149},"AWS IAM Access Advisor",[150],{"id":151,"by":152,"text":153},"21264746","rzzzt","IAM also offers some built-in help for the removal part, by listing which services were accessed recently:…",{"value":155,"source":43,"evidence":156},"Open Policy Agent",[157],{"id":61,"by":11,"text":62},{"value":159,"source":70,"evidence":160},"HashiCorp Sentinel",[161],{"id":162,"by":163,"text":164},"21264709","philsnow","Hashicorp has a tool\u002Fframework for this, Sentinel https:\u002F\u002Fwww.hashicorp.com\u002Fsentinel\u002F I haven't used it in production. It uses an even-more-baroque syntax than terraform's HCL…",{"comments":166,"answered":167,"key":168},14,4,[169,172,173],{"id":170,"text":171},"21265101","I hear you. Generating IAM policies based on CloudTrail records would be amazing. See my comment here: https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=21262954#21264166 I hope to build this…",{"id":77,"text":78},{"id":174,"text":175},"21270273","Aardvark and Repokid revoke privileges based on AWS Access Advisor, which tells you when certain services have not been used within X amount of days\u002Fmonths. But it only does this…",{"commenters":177,"max_depth":167,"maker_replies":166,"first_comment_mins":178,"lifespan_hours":179},18,83,74,[181,183,185,187,189,191,195,197,198,199,200,203,206,207,208,212,213,216,217,219,221,222,224,226,229,231,232,234,239,243,245,247,249,252,255],[90,33,30,182,74,33],"project\u002Fneutral\u002Fidea",[170,33,33,184,11,32],"maker\u002Fneutral\u002Fidea",[129,33,33,186,130,33],"commenter\u002Fneutral\u002Fidea",[77,33,33,188,11,32],"commenter\u002Fneutral\u002Fnone",[73,33,31,190,74,33],"project\u002Fpositive\u002Fidea",[192,32,33,193,194,33],"21264622","other\u002Fneutral\u002Fnone","pawurb",[144,196,30,182,145,33],2,[174,196,33,188,11,32],[121,30,33,193,122,33],[46,30,33,186,11,32],[201,30,33,193,202,33],"21264885","k__",[204,30,33,193,205,33],"21267492","crucialfelix",[114,167,30,182,115,33],[49,167,33,182,11,32],[209,31,30,210,211,33],"21263919","project\u002Fneutral\u002Fdocs","dmlittle",[93,31,33,182,11,32],[214,31,33,193,215,33],"21265215","Twirrim",[151,31,33,193,152,33],[218,31,33,188,11,32],"21264822",[99,220,30,182,100,33],6,[61,220,33,188,11,32],[223,220,33,193,163,33],"21264680",[225,220,33,188,11,32],"21264840",[227,220,33,188,228,33],"21264228","jcims",[230,220,33,188,11,32],"21264280",[162,220,33,193,163,33],[233,220,33,193,11,32],"21264856",[235,236,31,237,238,33],"21266719",7,"project\u002Fpositive\u002Fnone","batoure",[240,236,31,241,242,33],"21268950","maker\u002Fpositive\u002Fnone","Terretta",[244,236,33,193,238,33],"21295440",[246,236,33,193,11,32],"21271342",[248,236,33,193,238,33],"21295437",[106,250,30,251,107,33],8,"project\u002Fmixed\u002Fdocs",[253,250,33,254,11,32],"21264973","maker\u002Fneutral\u002Fdocs",[256,250,33,254,11,32],"21265071",[],[259,264,268,272,276,280],{"id":260,"name":261,"points":262,"category":263},"21231208","Bel",1288,"languages",{"id":265,"name":266,"points":267,"category":20},"21215484","Spider Pro",391,{"id":269,"name":270,"points":271,"category":20},"21270424","Pipedream",245,{"id":273,"name":274,"points":275,"category":263},"21234891","dial",190,{"id":277,"name":278,"points":279,"category":20},"21268324","reloading",187,{"id":281,"name":282,"points":283,"category":284},"21253850","Alt-tab-macos",156,"productivity",false,"v2",{"id":288,"name":5,"line":6,"ai":285,"cat":20,"year":13,"points":14,"comments":15,"rec":27,"s":289,"top":18,"kw":290,"maker":11,"domain":10,"tier":19,"attempts":33,"strip":291,"url":9,"mix":292,"praise":69,"objection":81,"sub":21},21262954,0.18,[24,25,21,26],"30005030000030300003000000055000300",[30,31,32,33],1794036581993]