Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

"Guess" missing events #22

Closed
flosell opened this issue Dec 21, 2017 · 1 comment
Closed

"Guess" missing events #22

flosell opened this issue Dec 21, 2017 · 1 comment

Comments

@flosell
Copy link
Owner

flosell commented Dec 21, 2017

AS AN engineer that wants to create policies for terraform or cloudformation runs
I WANT trailscraper to guess permissions that likely are also necessary for the same infrastructure
SO THAT the generated policy works not only for the exact circumstances (e.g. an initial terraform apply) but also similar ones (e.g. terraform destroy/update of resources)

Examples

  • We saw an event for iam:DeleteAccessKey so we also add iam:CreateAccessKey, iam:UpdateAccessKey and iam:ListAccessKeys

Notes

  • Cloudonauts sources could possibly be used as a datasource to generate which IAM permissions exist
  • Once we have a good list of IAM permissions we can find matching ones, e.g. Delete{Something} and Describe{Something} when we have a Create{Something} event
  • This could be a separate command to make it more flexible and composable:
    $ trailscraper generate-policy | trailscraper expand-policy
flosell added a commit that referenced this issue Jun 9, 2018
flosell added a commit that referenced this issue Jun 9, 2018
flosell added a commit that referenced this issue Jun 10, 2018
flosell added a commit that referenced this issue Jun 10, 2018
flosell added a commit that referenced this issue Jun 10, 2018
@flosell
Copy link
Owner Author

flosell commented Jun 10, 2018

Basic support added trailscraper guess. More coverage and smarter guessing will be split out into separate issues

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant