4 ms·
Two problems with doing this: 1. If you provide an EC2 Role which allows setting that tag, any process on the instance which can access the Instance Metadata S
by cperciva 5y ago
Two problems with doing this:
1. If you provide an EC2 Role which allows setting that tag, any process on the instance which can access the Instance Metadata Store can record a different SSH fingerprint.
2. You can only have one EC2 Role attached at once, so doing this prevents you from using other roles.
- klohto 5y ago1. You can limit access to IMS to certain processes inside linux 2. Just combine the policies If you’re worried about malicious processes on the EC2 altering the fingerprint, you got bigger issues. You can also sign the fingerprint with gpg.
- jen20 5y agoIt’s worse than that with respect to (1): any process on _any_ instance which has tag setting permissions can set the tag for _any other_ instance, since conditions don’t support scoping to instance ID. Re (2) technically you cannot have any roles attached directly, but instead attach an instance profile (the distinction is clearer via the API than the console). The shape of the API for an instance profile clearly was designed to support multiple roles, but in practice is limited to one. It’s typical to create a role with many policies attached for each functional type of instance, so in practice it does’t matter too much.
- klohto 5y ago1) CreateTags does support scoping using StringEquals with ec2:SourceInstanceARN and comparing that with the aws:arn "aws:ARN": "${ec2:SourceInstanceARN}" It will give you a warning when creating through web console, but the condition works.
- jen20 5y agoTIL - thanks for the heads up. Is this a documented substitution?
- klohto 5y agoI don't think so... I have been trying to find it for a few years now, but it just won't turn up anywhere. FYI, I personally use resource tags as well on top this, just to limit the scope (in case it magically disappears one day).
- paulddraper 5y ago> any process on the instance which can access the Instance Metadata Store can record a different SSH fingerprint. A security issue really only if the process is able to pair it with a MITM attack. > You can only have EC2 Role attached at once. Yes, so attach this policy to that IAM role.