alt Hacker NewsFrom the security page [0]
> Don’t use the emulator to test the following:
> - IAM policies and permissions boundaries
> - Resource-based policies, such as bucket policies
> - AWS KMS key policies
> - Access across AWS accounts or across AWS Regions
> - Any other security control
> Some services in the emulator evaluate IAM policies for IAM users and roles that you create in the emulator, but not the same way as AWS. The emulator never denies a request signed with its own key. It doesn’t check AWS KMS key policies or Amazon S3 bucket policies. It also doesn’t support calls across accounts or Regions. So a request that AWS denies might succeed in the emulator. A request that AWS allows might fail.
This is a shame because I'd love for the official AWS product to be better than e.g. ministack and localstack on this, which will go some of the distance. I think because the agents were only building on the public API surface, it's hard to build this part. But they should've tried and let the agents read whatever policy engines AWS has. Or maybe it's a way to prevent someone from trivially running aws-emulator as AWSaaS?
[0] https://docs.aws.amazon.com/emulator/latest/userguide/securi...
Replies
The current IAM engine and language “balsa”, is its own thing. Its vended as a library with large “there be dragons” disclaimers if you even think about going outside the public interfaces. There are also big opaque interactions between different components like STS, KMS, service principals, service-specific resource policy evaluations, etc. I doubt that can be reasonably open sourced or exposed.
There was an attempt at a public implementation of the “next gen” AWS IAM language/engine with “cedar.” However I think that got sidetracked as an authz product and didnt have any real penetration with AWS IAM.
I shudder at the thought that local emulation is somehow supposed to handle IAM conditions like source VPC endpoints, EKS Pod Identity, chained roles originating from web identity providers...
IAM itself is free. Most IAM conditions involve resources which are free (e.g. VPC gateway endpoints, web identity providers) or which are free additions on top of a cluster you have for other purposes (e.g. EKS Pod Identity). Presumably you already have an AWS account. What value does an emulator give here?
I suppose it would have been extremely complex to replicate all of that. Maybe they thought it’s out of the scope to emulate all security patterns locally, they just wanted to focus into providing a native alternative to let users do integration tests.
I've implemented the AWS IAM engine and all policy types, conditions, etc in here if you want to try it out. It's the most thorough in terms of edge case coverage I'm aware of and I'm constantly adding enhancements and closing edge cases.
https://github.com/act-security-labs/iam-lens
It uses https://github.com/act-security-labs/iam-collect to get all the policies which includes example terraform to gather all the data at scale.