aws-leastprivilege VS policy_sentry

From a template, this is the closest I've gotten: https://github.com/iann0036/aws-leastprivilege , and also check out iamlive (thanks /u/rowanu!) if you can insert the recorder between the application and the AWS endpoints.

Check out https://github.com/iann0036/aws-leastprivilege, though note that it doesn't currently support SAM, so you might want to create a change set and grab the transformed template to use.

I've personally attempted to fix this before with https://github.com/iann0036/aws-leastprivilege, which uses mappings with permissions (based on some incremental permissions testing), but also defaults down to examining the permission schemes publicly available in some (but not all) resource types. More info in the README.

All of the sdks support client side monitoring (CSM), so these sort of tools can be built client side. https://boto3.amazonaws.com/v1/documentation/api/1.10.46/gui...

afaics the only challenge is mapping some of the apis to iam as its only 85% 1:1

There's also tools for helping with iam like (generator, and linter)

https://github.com/salesforce/policy_sentry

https://github.com/duo-labs/parliament

It is an open source initiative from Salesforce. Using Policy Sentry, it is easy to automate the creation of IAM policies with little knowledge on security.

You can use tools like policy_sentry to create least privilege IAM policies.

The tool is in a similar space to iamlive, policy_sentry, and consoleme (all of which are worth checking out too if you're interested in making AWS security easier) but the main points of difference I see are:

@kmcquade ur awesome ! we are users of https://github.com/salesforce/policy_sentry and definitely definitely https://github.com/salesforce/cloudsplaining .

If I could give you guys money, I would. You should totally build a startup around it.