Olaf Conijn

Serverless @ Stedi,
Maintainer @ org-formation, ts2asl

[Olaf Conijn @OConijn]

@matthewdfuller Book a bassinet with your airline, good luck

[Olaf Conijn @OConijn]

@matthewdfuller for example: https://t.co/nszwvEtAoE

[Olaf Conijn @OConijn]

@matthewdfuller A rather neat (and little known!) thing about the CloudControl API is that it is extensible by the customer. you can create new types for things AWS does not support and this wouldnt just work with CloudControl but also in CloudFormation templates

[Olaf Conijn @OConijn]

@zackkanter @matthewdfuller Access Analyser would return all access that is provided based on condition keys such as aws:PrincipalOrgID or aws:PrincipalOrgPaths

[Olaf Conijn @OConijn]

@zackkanter @matthewdfuller question 1 through 3 seem relatively simple.

to answer question 4 i would have a look at IAM Access Analyser to perform "external access analysis". it is real sophisticated in analysing both the identity and resource policies within an AWS Account.

[Ben Kehoe @ben11kehoe]

Don't use custom resources, use resource providers!

[Zack Kanter @zackkanter]

Security is job zero @Stedi. While building Stedi's RBAC system, our very own @williamsross discovered an AWS access vulnerability in STS. We worked with @AWSSecurityInfo to report the issue (which is now resolved, and didn't affect Stedi customers). Full details in the blog.

[Olaf Conijn @OConijn]

@theburningmonk Or maybe the generation of short lived (security) tokens where some services read (check) and a different (authentication) services writes/invalidates the tokens

[Olaf Conijn @OConijn]

@theburningmonk Maybe think of it this way: now DynamoDB can be your service, the resource policy can define your service boundary. DynamoDB is a great service and you do not need to front it with an API GW for all usecases.

Next up would be ABAC support if it were up to me :)

[Olaf Conijn @OConijn]

@theburningmonk Concrete usecase: use DynamoDB as a service to provide atomic increments on control numbers/sequential IDs

Its great to have that as a shared service if you need writes and reads from different accounts/services.

[Olaf Conijn @OConijn]

@marcinph @thdxr Turns out writing a compiler for sfn also is a ton of code to maintain 😅

[Olaf Conijn @OConijn]

I think what this world needs is an aws "control tower" formation

[Olaf Conijn @OConijn]

@FilipPyrek @tlakomy CDK yes, SST not natively. Happy to help get started

[Olaf Conijn @OConijn]

@theburningmonk Must only happen to nice people?

[Olaf Conijn @OConijn]

Set your BucketPolicy to retain in CloudFormation & keep your data secure even after a bucket failed deletion.

see: https://t.co/WpcQDgAgo7

[Olaf Conijn @OConijn]

other recent new changes include:
- improved TF support
- https://t.co/mdckWjfvmU v2 support
- MaxConcurrentTasks > 0 on update-cdk tasks

[Olaf Conijn @OConijn]

org-formation v1.0.11, the org-formation version that can be used together with AWS Control Tower (or any other account factory) using the annotate-organization tasks.

https://t.co/YInEOIaBvF

[Olaf Conijn @OConijn]

why? companies might want to use Control Tower to create new accounts, but would like to use org-formation to manage a baseline of resources within those accounts.

[Olaf Conijn @OConijn]

@marekq @t1agoB @Sarutule @ottokruse @NMoutschen @heitor_lessa @theburningmonk a year ago it would have been about serverless, nowadays most of the people sitting at this table ship containers🙈