The document discusses Netflix's strategy for implementing least privilege on AWS accounts using tools they developed called Aardvark and Repokid. It involves giving applications base permissions for common deployment tasks, continuously profiling roles to remove unused permissions, and deleting roles when applications are no longer used. Several considerations are discussed, such as preserving permissions for infrequent tasks, handling errors, and accounting for untracked services. Future work proposed includes tightening base IAM using repo data and using application introspection to dynamically assign minimum required permissions.

1. RepoingIAMPermissions
OurstrategyforAWSLeastPrivilege
PatrickKelley
TravisMcPeak

2. Agenda
●Introandcontextsetting
●Approaches
●Aardvark&Repokid
●Futurework

3. Intro

4. ●GeneralDynamics->eBay->Netflix
●Decenttrampolinejumper
●SecurityMonkey,CloudAux,Aardvark,Repokid
PatrickKelley

5. ●Symantec->HP->IBM->Netflix
●OpenStackSecurity,CloudFoundrySecurity,OWASPBayArea
●Bandit,Recon,Aardvark,Repokid
TravisMcPeak

6. Netflix
LargeAWSdeployment
●100K+instances
●Thousandsofapplications
●Over50AWSaccounts
Mediumengineering
●~2000inproduct
●~50securityengineers

7. Netflix
Culturedrivesourdecisions,includingthiswork
●FreedomandResponsibility
●Context,notControl

8. IAMRecap

9. LeastPrivilege
Onlygranttherequiredaccess
necessarytoperformlegitimate
functions.
SeemscontrarytoNetflixFreedomand
Responsibilityvalue.
Thetrickistobalance.

10. FirstCut

11. Developersrequestspecific
permissionstheyneedtodeployand
runtheirapp.
Soundsreasonable...

12. ●86services*
●2318permissions*
●Hardtoknowbasedonname
●Whataboutdependencies?
●Hardtogetrightonfirst,second,thirdpass...
Developersdon’tknowwhattheyneed
*AccordingtoPolicyUniverse,updated5/31

13. PossibleApproaches

14. Profileintest,thendeploytoprod

15. Startwithnopermissions,add
incrementally

16. Havedevelopersaddtheirown
permissionswithself-service
model

17. OurApproach

18. ●Appsgivenpermissionscommonlyusedduringdeployment
○Ifmoreneeded,wehaveaquickconversation
●Profiletherolecontinuously
●Takeawayunusedpermissions
●Deletetherolewhenit’snolongerused
(Mostly)automatedrolelifecycle

19. ●DevelopersuseSpinnaker
●Spinnaker->Lambdawithinformation
abouttheapp
●Lambdacreatesaroleandgives
“base”permissions
○Basepermissionsdependon
typeofappandaccount.
Developerdeploysnewapp

20. ●CurrentlyusingAccessAdvisor
○WilluseCloudTrailsoon
●Findoutwhichpermissionsanappisusing
●Watchdenied/AAforservicesthataren’tallowed
○Eithermisconfigurationorattack
Profilerolecontinuously

21. ●Takeawaypermissionsthathaven’tbeenusedrecently
○Hasthesidebenefitthatunusedappslosepriv
●Storeoldversionofpolicysowecanrollbackifneeded
●Soon:automaticallyrollbackifCloudTrailshowsdenied
Repounusedpermissions

22. Attack!
●Alreadydemonstratedreal-worldbenefits
○Internaltesting
○Responsibledisclosureprogram
●Somestopped,somenot
○Wecan’trepopermissionstheappactuallyneeds!

23. ●Unusedappswillalreadyhavebeenrepoedto0
●Finalstepistocleanuprolesthatarenolonger
attachedtoapplications
Deletetherolewhennolongerused

24. Aardvark

25. ●RetrieveandcacheAccessAdvisordatafromthe
console
●Mostlyfeaturecomplete,plantoswitchtoAccess
AdvisorAPIwhenavailablefromAWS
Aardvark(NetflixOSS)

27. Repokid

28. ●Scanroles,lookforunusedpermissions,takethem
away,makeiteasytorollback
●Chat-opsintegration:what’sbeingrepoed,opt-out,
rollback
●LongtermstrategicforNetflixSecurity
○CloudTrailintegration
○Notificationsandreportstoappowner
Repokid(NetflixOSS)

30. Considerations/Edge-cases

31. ●Newpermissionsshouldn’tgetrepoedforawhile
○Needtomakeiteasyfordeveloperstogetnewpermissions
Needtoconsider

32. ●Newpermissionsshouldn’tgetrepoedforawhile
○Needtomakeiteasyfordeveloperstogetnewpermissions
●Whatshouldwedotopreserveinfrequentlyusedpermissions?
○Suchasthoseusedindisasterrecovery
Needtoconsider

33. ●Newpermissionsshouldn’tgetrepoedforawhile
○Needtomakeiteasyfordeveloperstogetnewpermissions
●Whatshouldwedotopreserveinfrequentlyusedpermissions?
○Suchasthoseusedindisasterrecovery
●Whatifsomethingbreaks?
Needtoconsider

34. ●Newpermissionsshouldn’tgetrepoedforawhile
○Needtomakeiteasyfordeveloperstogetnewpermissions
●Whatshouldwedotopreserveinfrequentlyusedpermissions?
○Suchasthoseusedindisasterrecovery
●Whatifsomethingbreaks?
●Untrackedservices(Lightsail)
Needtoconsider

35. ●Newpermissionsshouldn’tgetrepoedforawhile
○Needtomakeiteasyfordeveloperstogetnewpermissions
●Whatshouldwedotopreserveinfrequentlyusedpermissions?
○Suchasthoseusedindisasterrecovery
●Whatifsomethingbreaks?
●Untrackedservices(Lightsail)
●NewlyreleasedservicesmightnotbeinCT/AAyet
Needtoconsider

36. ●Newpermissionsshouldn’tgetrepoedforawhile
○Needtomakeiteasyfordeveloperstogetnewpermissions
●Whatshouldwedotopreserveinfrequentlyusedpermissions?
○Suchasthoseusedindisasterrecovery
●Whatifsomethingbreaks?
●Untrackedservices(Lightsail)
●NewlyreleasedservicesmightnotbeinCT/AAyet
●Ifpoliciesuseawildcard,newpermissionsmightbeautomaticallyadded
○rds:create*mightgrowmorepowerfulovertime
Needtoconsider

37. ●Newpermissionsshouldn’tgetrepoedforawhile
○Needtomakeiteasyfordeveloperstogetnewpermissions
●Whatshouldwedotopreserveinfrequentlyusedpermissions?
○Suchasthoseusedindisasterrecovery
●Whatifsomethingbreaks?
●Untrackedservices(Lightsail)
●NewlyreleasedservicesmightnotbeinCT/AAyet
●Ifpoliciesuseawildcard,newpermissionsmightbeautomaticallyadded
○rds:create*mightgrowmorepowerfulovertime
●CloudTraildoesn’tmap1:1withpermissions
Needtoconsider

38. FutureWork

39. UserepodatatotightenbaseIAM
FrequentlyrepoedservicesshouldnotbeincludedinbaseIAMinthefirstplace.
-Wecantolerateasmallpercentageofdevelopersrequestingadditionalaccess

40. Introspection
Examineapplicationsastheyarebeingdeployedandgivethempermissionsbasedon
whattheyneed.
Example:canseethat:
-AspecificDynamotableisused
-Theapplicationreadsfromaspecificqueue

41. Thankyou.