policy_sentry VS cel-spec

All of the sdks support client side monitoring (CSM), so these sort of tools can be built client side. https://boto3.amazonaws.com/v1/documentation/api/1.10.46/gui...

afaics the only challenge is mapping some of the apis to iam as its only 85% 1:1

There's also tools for helping with iam like (generator, and linter)

https://github.com/salesforce/policy_sentry

https://github.com/duo-labs/parliament

It is an open source initiative from Salesforce. Using Policy Sentry, it is easy to automate the creation of IAM policies with little knowledge on security.

You can use tools like policy_sentry to create least privilege IAM policies.

The tool is in a similar space to iamlive, policy_sentry, and consoleme (all of which are worth checking out too if you're interested in making AWS security easier) but the main points of difference I see are:

@kmcquade ur awesome ! we are users of https://github.com/salesforce/policy_sentry and definitely definitely https://github.com/salesforce/cloudsplaining .

If I could give you guys money, I would. You should totally build a startup around it.

My employer uses a combination of Protocol Buffers (for the config schema definition) and Bazel/Starlark (for concrete instantiations). Configs are validated at build time and runtime using CEL (https://github.com/google/cel-spec).

The Common Expression Language (CEL) implements common semantics for expression evaluation, enabling different applications to more easily interoperate. https://github.com/google/cel-spec

Looks like Google invented a specification for a simple "expression language." -> https://github.com/google/cel-spec/blob/master/doc/langdef.md. Writing the expressions feels like writing Java, C++, Go, or TypeScript code. Google then released C++ and Go versions of this langauge as a library.

https://github.com/google/cel-spec unfortunately, it's in Go or C++. Of course I can write a binding to them. But is there any other similar that you would know of for Java? My other course of action would be to offload computation to another service using this library in Go, or Jsonnet or Open Policy Agent/Rego based evaluation, which I'd prefer not to. Executing JS in Java via Nashorn also an option but it'd be heavy weight.

Having a standard way to share expressions does seem quite useful, especially when it's multilingual.

[0]: https://github.com/google/cel-spec

There's more information about CEL and its specifications here

Especially when dealing with more complex match rules, I personally much prefer Caddy's matchers over building some weird-ass if constructs in Nginx. It also supports CEL for request matching, giving you access to extremely powerful logic, if you need it.