Feature Request: Least Privilege Collaboration

post by dan1 on Jun 8

Hello,

Curious to have your thoughts on a new role that helps lambda customers adhere to the principle of least privilege. The idea is that a “Collaborator” team member can log in at lambda.ai and use resources in their purview, and is unable to create or destroy any resources.

The scenario I have in mind is that a team of ML engineers use Lambda.ai for their work, and a subset of them are authorized to allocate resources and cause money to be spent. For example, if I’m a Collaborator, I am able to see resources in my assigned workspace and open Jupyter, but I am unable to create an instance or a cluster.

The Lambda docs call out the coarse nature of the current approach with a warning:

Be sure to invite only trusted persons to your account!
Currently, all user roles have permission to create, update, and delete Lambda Cloud resources.

This is a tough pill to swallow. Would you agree it makes sense to have a 3rd role to enable collaboration without opening the door to accidental or unauthorized infrastructure changes? A role like this would help customers adhere to the principle of least privilege.

Certainly I can share SSH keys, but that has its own set of problems. Alternatively, if there’s another way to provide Jupyter access on a running instance to a my team member without a lambda.ai account, I would like to hear about it.

Thank you,

Daniel

86 views

Related topics