IAM Policies: Good, Bad, Ugly

1

AWS Elastic Beanstalk

The Ugly: Allow and Not Allow. Using combinations of Allow and Deny (and NotAction) can be helpful BUT the logic has to be perfect or you can end up in a data breach like Capital One. "Elastic Beanstalk sample application with a database". More info..

#Cloud Hosting #Cloud Computing #Backend As A Service 37 social mentions

2

AWS Config

The Bad: Unscoped Service Actions. By far the most common form of broad permissions occurs when policies are scoped to a service but not to specific actions. AWS CloudFormation samples: the "AWS Config delivery channel and rules" template. See the audit here.

#Cloud Infrastructure #Monitoring Tools #Cloud Monitoring 17 social mentions