3 ms·
we use iam roles and credstash(dynamodb and kms) for retrieving database credentials. My comment was mostly in terms of the fact we cannot control the rotation
by voganmother42 10y ago
we use iam roles and credstash(dynamodb and kms) for retrieving database credentials. My comment was mostly in terms of the fact we cannot control the rotation for roles, say in the event of a breach like where someone committed keys to github and I can explicitly expire/rotate(assuming those keys were not themselves temporary and have not already expired :))
- gtsteve 10y agoI believe you can actually [0]. In a production setting it's a lot harder to accidentally leak the credentials - my concern would be if someone compromised the instance or if it was tricked into opening the instance store up to the net, such as a badly configured nginx instance (how you'd do that accidentally though I have no idea) [0] http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_revoke-sessions.html http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use...
- voganmother42 10y agoGood point! slightly less granular than per key but still very helpful, thanks!