Fewer rights and a smaller bill

A developer at a small firm pastes a cloud access key into a public code page by mistake. The key has every right in the account.

By Saturday a stranger has found it and started fifty large servers. On Monday the bill is £9,000. Two habits would have stopped this: fewer rights, and an alert on spending.

In the cloud, every request comes from an identity. It may be a person signing in, or a program such as the invoice service.

Each identity has a policy: a list of permissions. When a request arrives, the provider checks the policy. If the action is not on the list, the answer is no. Give each service its own role, so its rights are its own.

# The invoice service's policy: what it may do, and nothing else.
policy = ["read:orders", "write:invoices", "read:invoices"]

def allowed(policy, action):
    # The provider says yes only if the action is on the list.
    for rule in policy:
        if rule == action:
            return True
    return False

print("read:orders", allowed(policy, "read:orders"))
print("delete:invoices", allowed(policy, "delete:invoices"))
print("start:servers", allowed(policy, "start:servers"))

# Add "read:customers" to the policy, then check it the same way.

Least privilege means each identity gets only the rights its job needs. The invoice service writes invoices, so it may not delete them or start servers.

A star, *, in a rule usually means everything. delete:* means delete anything. A star saves typing, but it hands out rights nobody planned. If a key with a star leaks, the stranger gets all of them.

Most surprise bills come from things left running. Four habits help.

Switch off what you are not using, such as test servers at night. Pick the smallest size that does the job. Put a tag (a label you choose, such as team=payroll) on everything, so you can see who spends what. Set a budget alert, so a person hears about a jump the same day, not at the end of the month.