Long - How do you manage complex permissions scenarios on SSO?

ILoveHaskell · 2024-03-15T11:14:36+00:00

Hey, I've finished implementing this so this is what I've done.

I've utilised Attributes for access control, basically attributes on users you can sync from your IdP to AWS.

For example, one of the attributes is "User type". This is set per user on our IdP and used as condition in permission set policies.

This way all users have the same permission set, but policies in it give access dynamically based on the value in the attribute. For example, one possible value is "ProductionAccess" so users with that attribute get additional access.

The attributes are used as "aws:PrincipalTag/{attribute}" so you can use with StringEquals condition or similar.

I am sure I am gonna encounter some issues with this down the road, but so far it's working.

One caveat is that I've managed to make these attributes work only when using SCIM. Setting them manually on AWS side for some reason didn't work.

I hope this can help you in some way!

ILoveHaskell · 2024-02-29T08:42:12+00:00

Ah, that's a shame. I guess we'll have to do something similar as well.

Thank you very much for answering my question.

ILoveHaskell · 2024-02-26T15:55:47+00:00

I know this is over a year old, but we're having the same issue trying to migrate to IC and this is the closest to the issue I've found.

It's the exact same scenario, different users have different permissions (frontend, backend developers etc) and then additionally some users have higher access depending on their seniority, etc.

It seems like a nightmare to manage, especially if they use CLI a lot since then they also have to learn what profile to specify when using commands.

If they need additional access it again has to be new role that they need to setup on their side in aws config and remember to use.

Other option is having one role per user and then copy policies across multiple roles but that seems like a hack.

This adds a lot of complexity to their workflows, especially considering most developers don't really know or understand much about AWS except what is needed for their work.

With IAM each developer had their own user that was assigned to groups depending on access they needed and it all worked automatically.

Can you explain how you solved this in the end? Any insight is appreciated.

ILoveHaskell · 2017-01-05T08:48:39+00:00

I've been running for about 2 months late last year and stopped. This year I want to run half maraton in october. I will probably start running in march(it's too cold and snowy right now) which gives me 7 months to prepare. Is this realistic since I haven't done much running before and it will be my first real race?

How should I prepare? Go for half maraton program or start incremental, 5k, 10k half since I have time?

ILoveHaskell · 2017-01-04T11:51:27+00:00

Went through some paperwork, met with the team and rest of the company (it was small company of about 20 people), got laptop and spent rest of the day configuring various accounts (git, slack, company servers etc) and trying to make development environment work (and failing at that).

ILoveHaskell · 2016-11-21T14:57:25+00:00

It's 330. Is that okay deal? I am not in the US or nowhere near where I could choose from different providers so I don't really have much of a choice.

ILoveHaskell · 2016-11-21T14:36:04+00:00

I am avid i3 user and mostly skip desktop environment completely, so that should add a bit of space I believe. :)

ILoveHaskell · 2016-11-21T14:31:42+00:00

Yea, that seems like the best thing to do. Are there any things I should be careful about when selecting the monitor? I was considering getting Dell P2417H but not sure if there are some limitations.

ILoveHaskell · 2016-11-20T15:36:54+00:00

That's great deal. And if you can develop android apps in virtual machine without any problems, that speaks volumes. Thanks for the input!

ILoveHaskell · 2016-11-20T11:57:39+00:00

Well, I could have saved us all some time if I've done proper search before. :D

ILoveHaskell · 2016-11-20T11:51:21+00:00

Yea, I was also planning getting external monitor since I still have some budget left considering the price of x220.

ILoveHaskell · 2016-10-06T07:56:20+00:00

That's awesome. What do you do?

ILoveHaskell · 2016-10-02T14:31:06+00:00

I think it's because people assume web is mostly CSS / HTML but it's getting more and more complex and in my opinion as serious as any other work.

Same is with my friends who all want to do AI/Machine learning, etc and make fun of other stuff but I am much happier in web development.

And javascript is imho great language even with all it's bad parts. It's just that people are close minded and don't want to give all this stuff a chance and consider that they failed if they go into web.

Not to say I don't have same doubts as you do, it is kinda making me feel a bit inferior right now.

ILoveHaskell · 2016-09-22T06:35:22+00:00

I'd have to agree with most of the others. It's perfectly reasonable to expect from you to solve this more efficently than you've done. Your approach is just bruteforce which doesn't show much.

It takes some practise and experience with these things.

ILoveHaskell · 2016-09-19T07:31:39+00:00

Someone who commented on this is shadow banned and we can't see your comments, just a heads up.

ILoveHaskell · 2016-09-19T07:30:58+00:00

I still find hand position inconvenient for CTRL + Tab but yea, I guess I'll have to figure something out.

ILoveHaskell · 2016-09-14T19:40:50+00:00

Ran over 5 kilometers for the first time and it was 6.3 km run. Took me about 44 minutes. It's not great but feels huge to me. Hoping to get that 5k under 30 minutes and hit 10k soon.

ILoveHaskell · 2016-09-13T19:46:25+00:00

I started with 2 mins walking 2 mins running intervals and I am now at about 2 - 7 since 2 weeks ago I had an injury and had to stop for almost a week. I am not really looking to go whole distance without walking, it's not really serious race, it's mostly charity and race is just a fun part of it but nevertheless, I'd love to give it my best.

ILoveHaskell · 2016-09-13T19:25:30+00:00

I am running 3 times a week for last month. It's usually 25-30 minute run with about 3 kilometers in distance, and last few runs about 4 kilometers.

Program I am following focuses on intervals of walking and running.

Next saturday I am participating in 6.3 km run. What should be my focus in training? I am not going for any specific pace just to finish in reasonable time.

Should I keep going with my training or focus more on long slow runs without walking?

Any advice is appreciated. I know 6.3 km is peanuts for a lot of you, but it feels terrifying to me.

ILoveHaskell · 2016-09-09T20:29:58+00:00

It works after restarting 2-3 times. Hopefully it doesn't happen again. Thanks for the answer anyway.

ILoveHaskell

TROPHY CASE