6 ms·
Awsviz.dev simplifying AWS IAM policies
- twosdai 2y agoLet me know when policy updates are no longer eventually consistent. It's the worst experience in the world. Update you policy, wait for some period of ykme, hopefully test it. Doesn't work? Maybe you didn't wait long ebougb, maybe you're dumb. Who knows!? Not me.
- bscript 2y agoSometimes, reading AWS IAM policies can be tough for me. I prefer visuals, so I often use the IAM Policy Simulator. To make things even easier, I built a small tool that turns IAM policies into simple graphs. awsviz.dev is a good tool designed to help users visualize, analyze, and improve their AWS IAM policies. More details: https://medium.com/@Bohr/introducing-awsviz-dev-simplifying-aws-iam-policies-2359d69f3e20 https://medium.com/@Bohr/introducing-awsviz-dev-simplifying-...
- kaladin-jasnah 2y agoShould this be a "Show HN" post?
- bscript 2y agoFirst time here, did not know about Show NH
- ckozlowski 2y agoWelcome!
- dandrew5 2y agoNew Hackers, I like it. A Hacker News clone strictly for new developers. Instead of articles, the links just map to posts on r/programmerhumor Welcome btw!
- itscrush 2y agoWelcome, it's detailed here; https://news.ycombinator.com/showhn.html https://news.ycombinator.com/showhn.html worth considering a post.
- lhousa 2y agoJust skimmed through the post but how is it different from a plain json visualiser like https://jsoncrack.com https://jsoncrack.com?
- l3x4ur1n 2y agoFirst thing that came to me after reading the url https://en.m.wikipedia.org/wiki/Auschwitz_concentration_camp https://en.m.wikipedia.org/wiki/Auschwitz_concentration_camp
- windowshopping 2y ago[flagged]
- bdcravens 2y agoPerhaps it would make sense to link to the repo on the page? As best I can tell, you can easily self-host your tool (would need to update the redirects in the index.html). https://github.com/BourAbdelhadi/awsviz https://github.com/BourAbdelhadi/awsviz
- zarzavat 2y agoThis is a very bad name for a product.
- bscript 2y agoYou might be right. My focus wasn't on the name; I just wanted to create something useful for my day-to-day job and share it with others. The goal was never to commercialize the product … so maybe that’s why the name was bad!
- sclangdon 2y agoHe may be referring to the fact that it could be pronounced Auschwitz. I must admit, my immediate thought on reading the name was "why would someone name their app after a concentration camp?"
- bscript 2y agowow, I learned something new today
- dgb23 2y agoI had the same reaction. Even just a hyphen between like aws-viz would probably do wonders.
- zarzavat 2y agoYes I think any minor tweak would remove the effect. awsvizul, vizaws, awsvista. It’s just a bit too on the nose at present.
- arresin 2y agoThis is also what I immediately saw and heard also.
- deleted 2y ago[deleted]
- cyberax 2y agoIAM policies can be so complex, that become close to unusable. Use multiple AWS accounts, and keep your policies simple. One account for DB, one for the backend servers, etc. Each environment (prod, staging, dev) also gets its own set of accounts. This way, a misconfigured policy won't give admin access to everything.
- potamic 2y agoWouldn't that lead to cross account policies, which appear to be even more quirky?
- cyberax 2y agoIn my practice? Not really. For resources like databases, you don't need cross-account access if you're using internal DB authentication systems. For IAM-based DB authentication, you can simply write policies to trust the target accounts. Occasionally, you'll need to create a cross-account trust (via AssumeRole), but it's not at all that frequent. My personal wish is for AWS to allow account _names_ instead of ID numbers in policies.
- devonkim 2y agoYeah, error messages start to become more opaque as well which makes debugging even tougher, which is kind of the opposite of the point of using multiple accounts. But really, AWS not having proper namespaces in its constructs that’s ubiquitously supported (IAM paths were attempted. Attempted) hampers a lot of things
- laurent_du 2y agoI honestly can't imagine a situation where this would be a good advice. Can you give an example of such an IAM policy?
- cyberax 2y agoFor example, if you want your CI/CD to deploy to CloudFormation and allow it to generate IAM resources, then it's essentially root-level access. Because you can simply create an IAM role that gives admin permissions to you. Or even without that, there are plenty of footguns. AWS has a good blog post: https://aws.amazon.com/blogs/security/protect-sensitive-data-in-the-cloud-with-automated-reasoning-zelkova/ https://aws.amazon.com/blogs/security/protect-sensitive-data...
- timendum 2y agoI think Policy Details card should have a scrollbar, but it is set to "overflow: hidden".
- bscript 2y agoGood point. Thanks
- egorfine 2y agoOkay, so I have no idea what to do with that web. I copied one of the complicated policy JSONs from AWS, now where do I paste it? What's there to upload? In zip?
- bscript 2y agopaste it to the IAM Policy JSON input or zip your json files and upload the zip.
- egorfine 2y agoAh, I can see you added JSON input. Tried it. It looks like the "The user is allowed to:" part is the most important one and should be on top. The graph visualization does not make any sense on my random JSON policy I have just pasted.
- bscript 2y agoyou can move the section to the top, just drag and drop.
- egorfine 2y agoI have been discussing IAM with a couple of AWS engineers from that team a few years ago. I have tried to convince them to implement something actually sane non-corporate developers, because IAM is complicated way beyond a point of being usable. I have seen so many people just slam the root credentials into config in order to never touch IAM. And yes, me included, and yes, it's a shameful practice, don't do that. Take a day off, go on a hike, watch the sunset, meditate and embrace the inevitable: yes IAM is incredibly bad and there is no way around. (I was heavily using AWS since inception, way before IAM was invented). My speech fell on deaf ears, because IAM is clear as sky to its inventors and they fail to see what's the problem in it and corporate customers are happy to employ one or two people solely dedicated to learning and managing IAM. Anyways. There is no way around IAM. And just like with systemd you better embrace it and learn it and it turns not that terrible.
- ak217 2y agoI'm not sure how IAM is any more difficult or harder to comprehend than any alternative. I've been using AWS since 2010 and frankly IAM has never been an issue. Can you give some examples? In any case, IAM and its essential features are not some optional thing; it's actually the prerequisite for AWS existing in its current form. IAM is the most universal AWS service - every other AWS service must use it. It's a loosely coupled symbolic policy computation engine for federated identity and service permissions. The "federated" part is doing A LOT of heavy lifting here: without federation, it's impossible to decouple teams and achieve the organizational velocity that AWS has. Other cloud providers have ended up re-inventing AWS IAM, sometimes poorly. Although I have to give GCP credit for recently greatly improving their IAM console and permissions error usability.
- bfLives 2y agoI think IAM would be a lot easier to interact with from a dev perspective if the error messages were more clear. I suspect that they are sometimes intentionally vague (or misleading) as a kind of security-through-obscurity. For example, S3 returns “file does not exist” errors when the real problem is that the caller doesn’t have permission to access the bucket/prefix.
- mauflows 2y ago
- Dowwie 2y agoIs this a claude artifact?
- nerdjon 2y agoIs there somewhere that outlines what is done with the uploads or is this all client side? I am reluctant to just upload an IAM Policy when that could include bucket names, databases, account names, etc. Things that could expose more information than I would like (both security and product related)
- bscript 2y agoClient side only, you can check the github repo
- nerdjon 2y agoAhh thank you, I did not realize this was open source. I might recommend putting a link to the github repo at the top or something, unless I am just looking right past it I don't see that anywhere (the most I see is the github script to copy)
- bscript 2y agoWill add the link to the website ;)
- ckozlowski 2y agoVery cool. What are you using to rate severity in the security scan? Is there a full list of checks being performed? I recommend having both resources in your documentation. If you're referencing another document, link to it. That way there's some context to the results as to why a policy author should change it. Just something to add to the improvement list. Looks good overall! Thanks for sharing!
- koromak 2y agoThe best part of any new stack: Spending 4 days repeatedly destroying and creating it while you figure out a single god damn policy to add to the project at a time
- Aeolun 2y agoStill better than just giving it all permissions to be done with it? At least it made me feel a little bit happy when I did this the first time.
- klysm 2y agoI've gotten a lot better at it by being boneheaded about not giving up. By bashing my head into IAM, I've gotten pretty good at figuring out the right set of permissions, roles, etc for cross account stuff to work. It's definitely still a mess a shitty, slow feedback loop, but it's better to have security by default.
- deleted 2y ago[deleted]
- rafaelturk 2y agoThis like this is what made us leave the cloud and go back to our own private cloud.
- JustAnotherJeff 2y agoYou just made me want to stop lurking and register to say Thank You. I have a bunch of users that keep producing blatantly wrong IAM policies, I hope such visualisation will help putting some sense in what they write. Very good and straightforward - thanks a lot for providing the GitHub repo as well as I would never tell them to paste policies on a random website.
- tobilg 2y agoI publish a daily updated AWS IAM dataset at https://github.com/tobilg/aws-iam-data https://github.com/tobilg/aws-iam-data as well as historized managed IAM policies at https://github.com/tobilg/aws-iam-managed-policies https://github.com/tobilg/aws-iam-managed-policies There's also https://www.awsiamdata.com/ https://www.awsiamdata.com/ which analyzes the AWS IAM data and also contains a changelog. Maybe this helps some people. You can also query the data from your browser: https://tobilg.com/chat-with-a-duck#heading-explore-aws-iam-data-with-the-help-of-ai https://tobilg.com/chat-with-a-duck#heading-explore-aws-iam-...
- playingalong 2y agoYou might consider adding git-scraping label to your repo.
- redeux 2y agoThanks for sharing this! Very useful data. The contrast on your dashboard at https://www.awsiamdata.com/ https://www.awsiamdata.com/ makes it almost impossible to read. You may want to take a look at that.
- otteromkram 2y agoThis is interesting. Is it just a reference package for npm? As in, you can't set/update policies with it or do other IAM ops with it, correct?
- glzone1 2y agoIsn't there a way to basically give your project root in a separate account, then use cloudtrail to figure out what policies it actually needs? I've not been able to get that going myself but it seems like a more efficient approach potentially.
- turtlebits 2y agoYou can use Access advisor to see which service your IAM role/user has accessed and when. You can then prune permissions which haven't been recently used.