this post was submitted on 04 Dec 2023
17 points (94.7% liked)
Programming
17366 readers
227 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities !webdev@programming.dev
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
If I'm reading the Github page correctly, the service serves as its own authoritative storage for the requests? If yes, that's a blocker for most organizations that could use this because they'll never trust a new tool like this with their sensitive data. It can be useful for modeling and orchestrating request flows that work with other APIs, provided it never touches data at rest.
What sort of sensitive data are you imagining in your reading of the README? It would be useful to understand to update the language appropriately ๐
Well the actual rules โ who gets access to what โ where is that stored and how is it secured, to what standards? Is there logging, audit, non-repudiation, tamper-proof, time-stamping etc.
tl;dr all the same caveats with self-hosted software apply; don't do anything you wouldn't do with a self hosted database or monitoring stack.
The rules themselves are the same public rules in the IAM docs on AWS, GCP etc., while the collections of these public rules (eg. the
storage_analytics_roexample in the README) defined at the org level will likely be stored in two ways: 1) in a (presumably private) infra-as-code repo most probably using the Terraform provider or a future Pulumi provider, 2) the data store backing the service which I talk about more below."Who received access to what" is something that is tracked in the runtime logs and audit logs, but as this is a temporary elevated access management solution where anyone who is given access to the service can make a request that can be approved or denied, this is not the right place or tool for a general long-lived least-privilege mapping of "this rule => this person/this whole team".
This is largely up to the the team responsible for the implementation and maintenance, just like it would be for a self-hosted monitoring stack like Prom + Grafana or a self-hosted PostgreSQL instance; you can have your data exposed through public IPs, FQDNs and buckets with PostgreSQL or Prom + Grafana, or you can have them completely locked down and only available through a private network, and the same applies with Satounki.
Yes, yes, yes, yes and yes, though the degree of confidence in each of these depends to some degree on the competence of the people responsible for the implementation and the maintenance of the service as is the case with all things self-hosted.
If deployed in an organization which doesn't adhere to at least a basic least-privilege permissions approach, there is nothing stopping a bad internal actor with Administrator permissions wherever this is deployed from opening up the database directly and making whatever malicious changes they want.