> I will also echo what others have said: allowing another account access to ours is a non-starter, even if Read-Only. It needs to use a security principal we have complete control over.

You own and control the IAM role, not us. You allow Atlasphere to assume that role, and then Atlasphere's discovery service uses it to discover your resources.

Technically, Atlasphere doesn't need a ton of permissions. If you create a role that can only list, say, Lambda functions, then Atlasphere will only find Lambda functions.

IAM provides a default ReadOnly policy that can be attached to any role. This was the simplest way for me to get things going. But ReadOnly is indeed way too broad. I could generate an IAM policy based on the AWS services that Atlasphere can work with.

> I can tell from this post and the site that this is a labor of love, and I hope you keep up the good work. Like I said, this is an area where we need more, better tools. I want projects like this to succeed.

Thanks a ton! There are mind-blowing features in the roadmap. I want Atlasphere to succeed.

Yea, that cross-account trust is a good call out. I'll need to spend time thinking more about it. Is there anything i could do such that you could say: 'Well, in this case I'm fine with cross-account access from a stranger like you'?

Comments URL: https://news.ycombinator.com/item?id=48465201

Points: 2

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=48460938

Points: 2

# Comments: 5

I was once building a pet project that allowed customers to spin up fully synchronized blockchain nodes within just a few minutes. The backend was split into a control plane and a data plane, each with its own AWS account. Later I added two more AWS accounts. One for shared RPC nodes. One for the Analytics Service.

Since I love to visualize things, I used drawio to visualize the architecture.

With time, I noticed a pattern. I'd write some code, add a few lambda functions, update my drawio diagram, write more code, introduce a few more resources, test things, see that everything works fine and go to sleep with a smile on my face. Next week I'd check my diagram, and shockingly, it's missing some of the resources! This kept happening for a few more weeks until I decided to fully abandon the project until my infrastructure diagrams could stay in sync with my cloud account.

That's how Atlasphere.io was born. I've been working on it for the past 6 months and I think the product is ready for some feedback :)

A few notes:

- Atlasphere uses a ReadOnly IAM role to scan your AWS account (my account reaches your account through a trust relationship).

- The number of services is currently limited (WIP)

- It's a macOS app

- It's NOT an Electron app, i use Rust + Webview

What am I looking for? All I really need is for someone to try the app and tell me what they like about it and what they absolutely hate about it, haha!

The website is https://atlasphere.io/

Comments URL: https://news.ycombinator.com/item?id=48460286

Points: 21

# Comments: 12

Comments URL: https://news.ycombinator.com/item?id=47829080

Points: 5

# Comments: 0

They are wrong. The current administration did not make a call to widen the permissions or make it intentionally overly broad.

> This pretty much insinuates Biden (and Trump v1, and Obama, and Bush) didn't fix it.

Why do you believe the president is responsible? Could be just a lazy contractor.