Comparison
Permission boundaryvsPolicy as code
Permission boundary
teams can create their own roles, and none of the roles they create can exceed the ceiling you set.
A policy that caps the maximum permissions an identity can ever have, regardless of what is granted to it. It is what makes delegating permission management safe, because it separates 'who may grant' from 'what may be granted'. Without one, giving a team the ability to create roles is equivalent to giving them administrator access, via one extra step.
Full entry →Policy as code
the rule that every workload must set resource limits is a file with tests, and it fails the pipeline rather than a review.
Expressing organisational rules as executable, versioned, testable code evaluated automatically. It converts standards from documents people are supposed to have read into checks that run, and it makes exceptions explicit and reviewable rather than tacit. Rolling it out in report-only mode first is essential, because a policy applied to an existing estate always turns out to have more violations than anyone predicted.
Full entry →