Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
scottwinkler authored Jan 16, 2020
1 parent b04f4c6 commit ec9de11
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# terraform-policymaker
This project solves the problem of creating a least priviliged policy for terraform deployments. If you have ever had to sift through logs files to know exactly what your priviliges you need to grant your terraform provider, then you will appreciate this.
## How to use
First build this project using `go build`, then run `./terraform-policymaker -path=<path_to_tf_config>` to generate a least priviliged policy for your configuration code.
First build this project using `go build`, then run `./terraform-policymaker -path="<path_to_tf_config>"` to generate a least priviliged policy for your configuration code.
Arguments
* -path: (optional) The path to your Terraform configuration files. Default: ./test
* -provider: (optional) N/A as currently only aws is supported. Default: aws
Expand Down Expand Up @@ -35,4 +35,4 @@ Another problem is that there is inconsistency in the golang sdk for aws such th
## Future Improvements
Currently this lists creates a policy that allows actions for all resources. A better policy would scope actions to particular resources, which is definetly possible since we have access to the terraform configuration.

Another thing would be to refine it for just the actions you need for a given deployment. Instead of creating a policy for everything, you really only need permissions for what has changed, and read permissions for everything else.
Another thing would be to refine it for just the actions you need for a given deployment. Instead of creating a policy for everything, you really only need permissions for what has changed, and read permissions for everything else.

0 comments on commit ec9de11

Please sign in to comment.