4 ms·
Up next: Why you shouldn't shoot yourself in the face
by nprateem 7y ago
Up next: Why you shouldn't shoot yourself in the face
- scarface74 7y agoTrue but it doesn’t help that most examples of “how to do $x in AWS” includes the secret key and access key in the constructor.
- SwiftyBug 7y agoMy credentials are still in the constructor, but are accessed through environment variables set in the CloudFormation file, like this: const client = new DocumentClient({ region: process.env.REGION, accessKeyId: process.env.ACCESS_KEY_ID, secretAccessKey: process.env.SECRET_ACCESS_KEY }); Is this still a bad practice?
- scarface74 7y agoYes, because now your credentials are in a cloud formation file that is still in source control. You don’t need your credentials anywhere near your code. Every AWS SDK that I’m aware of, let’s you new up your client with no parameters. Your credentials should be in your user directory set by “aws configure” locally. When running on AWS, the SDK will automatically get your credentials based on the role attached to your EC2 instance or lambda.
- NikkiA 7y agoWell, it does mean I don't need any kind of privileged access to your container, just 'ps -auwwe' as any user.
- scarface74 7y agoIf you are on the EC2 instance where you can do ps, you can already access the secret key and access key by just doing: curl http://169.254.169.254/latest/meta-data/iam/security-credentials But of course, you still shouldn't specify them in your code.