3 ms·
Ever worked in government? You won't get (full) admin access there, either. I thought it was good practice to have strong separation between Dev and Production
by voltagex_ 9y ago
Ever worked in government? You won't get (full) admin access there, either.
I thought it was good practice to have strong separation between Dev and Production, and I'm pretty sure you're meant to create AWS keys+accounts with less-than-root access for day-to-day work.
- scarface74 9y agoYes. I create separate roles for different ec2 instances, Lambda expressions, etc. based on least privilege. With AWS databases - except for DynamoDB - you still use traditional user names/passwords most of the time. Those are stored in ParameterStore and encrypted with keys that not every service has access to. Of course key access is logged. There is a difference between the root account and an administrator account. Day to day work on the console is configuring resources. Even if you do have strong separation -in our case separate VPCs, someone has to have access to administer it. We don't have a separate "network operations" department.