Hacker News Reader

FYI for anyone in the same situation, Netflix built some open source packages to solve this:

https://netflixtechblog.com/introducing-aardvark-and-repokid...

The idea is that the default policy on new things is deny all, and then it monitors cloudtrail for privilege failures and reconfigures IAM to allow the smallest possible privilege to get rid of that deny message.

View on HN

Offering this service can probably be spun into its own SAAS company.

So it gives a services any privilege it asks for? I haven't read the article, but from your description it doesn't sound much better than default allow-all.

It sounds a lot better. Set up your script and run it and the tool determines the minimum set of permissions needed for future runs. You lock that permission set in for future runs. Read the link

> You lock that permission set in for future runs

Thanks, that was the important bit missing from OP's description.

Reply on news.ycombinator.com