3 ms·
My credentials are still in the constructor, but are accessed through environment variables set in the CloudFormation file, like this: const client = new Doc
by SwiftyBug 7y ago
My credentials are still in the constructor, but are accessed through environment variables set in the CloudFormation file, like this:
const client = new DocumentClient({
region: process.env.REGION,
accessKeyId: process.env.ACCESS_KEY_ID,
secretAccessKey: process.env.SECRET_ACCESS_KEY
});
Is this still a bad practice?
- scarface74 7y agoYes, because now your credentials are in a cloud formation file that is still in source control. You don’t need your credentials anywhere near your code. Every AWS SDK that I’m aware of, let’s you new up your client with no parameters. Your credentials should be in your user directory set by “aws configure” locally. When running on AWS, the SDK will automatically get your credentials based on the role attached to your EC2 instance or lambda.
- NikkiA 7y agoWell, it does mean I don't need any kind of privileged access to your container, just 'ps -auwwe' as any user.
- scarface74 7y agoIf you are on the EC2 instance where you can do ps, you can already access the secret key and access key by just doing: curl http://169.254.169.254/latest/meta-data/iam/security-credentials But of course, you still shouldn't specify them in your code.