4 ms·
I'm so refreshed to see this designed this way. I assumed that they would be asking for an API key or equivalent, because I don't know anything about the prod
by philsnow 6y ago
I'm so refreshed to see this designed this way. I assumed that they would be asking for an API key or equivalent, because I don't know anything about the product team or the company and this bad behavior is so bog-standard.
I beg you to blog heavily about this approach, especially if you find success with it / it doesn't provide a very negative user experience. See if you can get featured on enterpriseready.io or something.
- StratusBen 6y agoHey, thanks for that comment and I'm glad folks are noticing our approach. We are happy to blog about it. We've had a tremendous amount of success with it. Security is a top concern of ours and this was really the only option for what we are doing.
- EduardoBautista 6y agoI am confused by your comment. How do they access the role they create if not through keys?
- timtylin 6y agoYou can allow IAM roles in your account (which simply just has the permissions defined, with no keys or other credentials associated) to be assumed by identities in another account. Vantage would then be responsible for securing credentials for the target identity in their account, but there would be no transfer of keys involved whatsoever from one party to another.
- poxrud 6y agoYou can create a role with certain permissions in your account. You can then configure this role to only be assumed by another user in another specific AWS account. This is how you can share resources between different AWS accounts.