4 ms·
How are you dealing with software that expect to get aws tokens? Especially with sts AssumeRoles only lasting up to one hour? For example, if you want to run t
by ah- 9y ago
How are you dealing with software that expect to get aws tokens? Especially with sts AssumeRoles only lasting up to one hour?
For example, if you want to run the Athena JDBC driver locally or read something from S3 in a longish (>1h) running Python script.
- stiveridibla 9y agoI can't answer for Segment, but our AWS account strategy is very similar, so we've found that there is still a need for a centralized KMS solution (system-to-system auth). Our teams are working on a project to wrap more tooling around Vault and make it a centralized KMS. T-Mobile has done some work on this... https://opensource.t-mobile.com/blog/posts/introducing-tvault/ https://opensource.t-mobile.com/blog/posts/introducing-tvaul...
- idunno246 9y agoIf you use aws-vault --server or something like it that mocks a metadata server, all the sdks handle rotation properly. Just need to fork to connect it to whatever generates tokens