sudo give the cloud

Lightning talk about BlaBlaCar in-house slack command to obtain temporary privileges on GCP. This tool is part of our least privilege strategy in the Cloud while still providing devs autonomy and capabilities.

Transcript

1. $ give the cloud $ sudo give me the cloud Jérémy Courtial - Security Engineer
2. BlaBLaCar way to the cloud = Full CI/CD Least Privilege strategy +
3. But you know, sometimes production is all like ...
4. But you know, sometimes production is all like ...
5. Security Team: But nobody can't do anything in 
 production! Tech teams: Life, uh, finds a way...
6. Modern Security 101 Don't try to block the flow, guide him.
7. Permissions are just one 
 Slack command away
8. #slackbot
9. #security
10. #slackbot
11. #security
12. #security
13. #security
14. Autonomy Transparency Tunable
15. How it works? Check identity using Slack & G-Suite APIs Must be part of the right group Use native GCP IAM bindings & roles Use GCP logs to compute expiration