3 ms·
You don't need AWS keys at all. This enrollment flow flies in the face of best practices. Intead, you should be providing your users with instructions to creat
by subway 9y ago
You don't need AWS keys at all. This enrollment flow flies in the face of best practices.
Intead, you should be providing your users with instructions to create an IAM role for cross-account utilization. Ideally in addition to the instructions, you'd provide a minimal CloudFormation template defining such a role, with your minimum required permissions.
Asking a customer to create a user and ship you a secret is asking for trouble.
- schlarpc 9y agoAnd when you use a role like this, you really should use an external ID to avoid confused deputy attacks. http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_cre...
- samstave 9y agoDING DING DING The problem is that a junior level of exposure may result in access+secrets being mistakenly given out. Yeah - they should be looking into say, cloudability, or any number of thousands of offerings ding just this.