Supercharge API RBAC with eBPF
Tags: iam, apisecurity, ebpf, apiobservability
Published: 2022-05-26 01:37:46

## IAM is complex in Microservices

Modern applications are comprised of APIs and complex Identity & Access Management ([IAM](https://www.gartner.com/en/information-technology/glossary/identity-and-access-management-iam)) constraints.

IAM involves Role Based Access Control (RBAC) policies, that try to answer the following questions:

- What is the identity of the user making the request?
- What are their role (or scope) entitlements?
- Does the role give them access to the API operation they are attempting?
- Does the role given them access to specific JSON objects being requested?

## Suboptimal IAM configuration leads to authorization exploits
Given the complexity of API, roles, and associated RBAC policies, it is very easy to misconfigure authorization, resulting in dangerous exploits that leak customer data.

![Horizontal Authorization Exploit](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9yn7rzwoziu1sbyfmzz8.png)
<figcaption>
<a href="https://docs.levo.ai/vulnerabilities/v1/OWASP-API-10/A1-BOLA"> Horizontal Authorization Exploit</a>
</figcaption>


![Vertical Authorization Exploit](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yov4f5x2thdr4diuyc2v.png)
<figcaption>
<a href="https://docs.levo.ai/vulnerabilities/v1/OWASP-API-10/A5-BFLA"> Vertical Authorization Exploit</a>
</figcaption>

## Preventing IAM abuse requires API observability
Preventing authentication & authorization exploits requires the continuous monitoring of your users, their role entitlements and the specific APIs/JSON objects they are trying to access.

![User Entitlements](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r3c8jpkowkf13f3cygln.png)
At a minimum you need to be able to answer the following questions:

1. Who are my users?
2. What are the role entitlements for these users?
3. What specific API endpoints and JSON objects are being accessed via the role entitlements?

## Current observability methods are too intrusive

![Network Packet Capture](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cgocbgv5qpppy672vtrs.png)
<figcaption>
<a href="https://en.wikipedia.org/wiki/Pcap"> Packet Capture — no TLS visibility & too CPU intensive </a>
</figcaption>

![Open Telemetry](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pv49rmlyujf4hoiap05l.png)
<figcaption>
<a href="https://opentelemetry.io/docs/collector/getting-started/#agent">  InApp Agents — require code changes & lead to increased latency</a>
</figcaption>

![Side-car Proxy](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1b6qcd4z0calb79s1l9w.png)
<figcaption>
<a href="https://istio.io/latest/docs/reference/config/networking/sidecar/">  Sidecar Agents — require code changes & lead to increased latency</a>
</figcaption>

Conventional observability is based on Traffic Mirroring (packet capture), In-App Agents, or Sidecar Proxy Agents.

All these techniques require application code/config changes, lead to increased application latency, and increased operational overhead (additional steps during debugging, upgrading, etc.)

Conventional tools result in increased friction between Developers, Operations, and Security.

## eBPF enables frictionless IAM Observability
[eBPF](https://www.brendangregg.com/blog/2016-03-05/linux-bpf-superpowers.html) is a revolutionary technology that provides [superpowers](https://levo.ai/iam_observability_via_ebpf/) for API observability.

[eBPF](https://ebpf.io/) probes can be used to passively instrument modern API driven apps, and capture the full request/response payloads of APIs.

![Levo's eBPF Based API Observability](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ph7ylcel6dzgim48dyih.png)

Below are top benefits of an eBPF based API observability solution:

- Instant & comprehensive observability for your APIs, roles, and users.
- Agent-less, and does not require code or configuration changes to your applications.
- Full TLS / SSL visibility for all applications and services.
- TLS observability does not require sharing of private keys.
- Completely passive, and not inline with the application.
- No impact to the application’s latency.
- No impact to daily operational workflows (debugging, upgrading, etc.).
- Eliminates friction between Developers, Operations, and Security, that is common with conventional tools.

## Want to learn more about eBPF powered API Observability?
You can learn more about frictionless API Observability & Security [here](https://levo.ai/).