Traffic safety: Auditing and enforcing IAM best practices
summary
Datadog demonstrates an identity-focused workflow: Datadog CIEM auto-enriches findings with AWS IAM Access Analyzer data, flags users who use <40% of granted actions, suggests downsized policies, and opens pull requests to fix Terraform so misconfigurations are remediated at the code source. The talk shows OIDC misconfigs (subject vs audience) that let GitHub Actions tokens be abused, cites alert-fatigue metrics (avg 30 min triage, 27% of alerts ignored at >1k firms), and demos live IaC remediation.
AI-written summary · about
chapters (19)
- 0:00Introduction to IAM
- 1:32The speaker's role
- 2:29Challenges in cloud security
- 5:00Impact of tool sprawl
- 7:48Strategies for improvement
- 10:13Observability and basics
- 12:20Common IAM terminology
- 15:29IAM auditing tools
- 20:13Demo of IAM monitoring
- 21:45Permissions gap detection
- 25:15Use case driven development
- 28:51Global condition keys
- 30:47Pre-production auditing
- 33:28CI/CD and tool monitoring
- 36:57Production auditing tools
- 38:56Risk-based findings
- 42:03Remediation strategies
- 44:28IAM remediation demo
- 46:33Proactive remediation and wrap up
related talks
01h 02mWhy IAM is the new perimeter, and how to govern it
38mChanging Perspectives: A Deep Dive into the Security Posture of 600+ Real-World AWS Environments
37mLocking Down the Security of IAM
33mAutomation Best Practices for SRE and Security
31mIAM and why it is important in Cloud environments
44mAuditing Your Automation's Access: Using More Automation
19mMove toward least privilege with IAM Access Analyzer
38mBuilding Security at Speed