Hacker News Reader

It did always strike me as somewhat unreasonable that my job trusts me with the ability to spin up an arbitrary number of $100/hour AWS instances, but not with purchasing a $60 mouse.

The bean counters only understand (and measure) one of those well enough to try to control it.

CIA: The Art of Simple Sabotage

https://www.cia.gov/stories/story/the-art-of-simple-sabotage...

Trust is a key enabler. I avoid low-trust environments, because nothing can get done there, everyone is suspicious and puts CYA first.

Ironically, a high-transparency, high-trust environment is exactly what makes teams of remote workers efficient. But it greatly helps in the office, too.

It’s kind of terrifying to have and give out admin powers with no oversight (except maybe forensics if we’re lucky). I’m interested in what alternatives could look like. Maybe provisioning requests take multiple signatures, like turning missile keys?

We use PIM in the Azure world. You can also use Azure PIM with AWS.

https://learn.microsoft.com/en-us/entra/id-governance/privil...