IAM Is the Worst (matduggan.com)

Article summary

The article discusses the complexity and challenges of Identity and Access Management (IAM) in cloud providers, particularly in AWS and GCP. The author argues that the current system is broken and proposes a solution where permissions are automatically scoped based on actual usage. The author also criticizes the current system for being overly complicated and prone to security risks. The article highlights the need for a more streamlined and automated approach to IAM.

Main themes

• IAM complexity
• Cloud security
• Access management
• Permission scoping
• Cloud provider comparison

What commenters say

• The current IAM system is not as complicated as the article makes it out to be, and a simple least privilege approach can be effective.
• Temporary privileges can be a useful security measure, but they may not be effective in all scenarios and can be circumvented by determined attackers.
• The article's proposed solution of automatically scoping permissions based on usage is a good idea, but it may not be feasible or practical in all cases.
• The lack of support for temporary privileges in GCP's console is a significant limitation, and workarounds such as using conditions or impersonating service accounts are not ideal.
• The use of Identity Governance tools can help to manage user entitlements and permissions, but may not be scalable or effective in all cases.
• The current IAM system is a necessary evil, and while it may be complex and cumbersome, it is still an important tool for managing access and security in cloud environments.