search

aws-samples / aws-parallelcluster-monitoring

Monitoring Dashboard for AWS ParallelCluster
MIT No Attribution
31 stars 23 forks source link

IAM permission: Principle of least privilege #29

Open bkirwan opened 10 months ago

bkirwan commented 10 months ago

Great solution, however, IAM permissions required provide a significant level of access to the head & compute nodes restricting the ability to deploy the solution into certain environments due to security concerns, 

- Policy: arn:aws:iam::aws:policy/CloudWatchFullAccess
- Policy: arn:aws:iam::aws:policy/AWSPriceListServiceFullAccess
- Policy: arn:aws:iam::aws:policy/AmazonSSMFullAccess
- Policy: arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess

A set of policies that follow the principle of least privilege providing the bare minimum required would help address security concerns

sean-smith commented 9 months ago

Great feedback - the way to approach this is to run the solution and record API calls using AWS CloudTrail then only add those permissions.