@matthewdfuller A rather neat (and little known!) thing about the CloudControl API is that it is extensible by the customer. you can create new types for things AWS does not support and this wouldnt just work with CloudControl but also in CloudFormation templates
@zackkanter@matthewdfuller Access Analyser would return all access that is provided based on condition keys such as aws:PrincipalOrgID or aws:PrincipalOrgPaths
@zackkanter@matthewdfuller question 1 through 3 seem relatively simple.
to answer question 4 i would have a look at IAM Access Analyser to perform "external access analysis". it is real sophisticated in analysing both the identity and resource policies within an AWS Account.
Security is job zero @Stedi. While building Stedi's RBAC system, our very own @williamsross discovered an AWS access vulnerability in STS. We worked with @AWSSecurityInfo to report the issue (which is now resolved, and didn't affect Stedi customers). Full details in the blog.
@theburningmonk Or maybe the generation of short lived (security) tokens where some services read (check) and a different (authentication) services writes/invalidates the tokens
@theburningmonk Maybe think of it this way: now DynamoDB can be your service, the resource policy can define your service boundary. DynamoDB is a great service and you do not need to front it with an API GW for all usecases.
Next up would be ABAC support if it were up to me :)
@theburningmonk Concrete usecase: use DynamoDB as a service to provide atomic increments on control numbers/sequential IDs
Its great to have that as a shared service if you need writes and reads from different accounts/services.
org-formation v1.0.11, the org-formation version that can be used together with AWS Control Tower (or any other account factory) using the annotate-organization tasks.
https://t.co/YInEOIaBvF
why? companies might want to use Control Tower to create new accounts, but would like to use org-formation to manage a baseline of resources within those accounts.