4 ms·
Less than a year ago, my team and I decided to develop an essential tool that securely manages programmatic (CLI/SDK) access to AWS resources distributed among
by andreacavagna 5y ago
Less than a year ago, my team and I decided to develop an essential tool that securely manages programmatic (CLI/SDK) access to AWS resources distributed among several Cloud accounts.
Temporary credentials access was a constraint for accessing the Cloud in our company, so we decided to build an open-source (https://github.com/Noovolari/leapp https://github.com/Noovolari/leapp) tool for every access method on your behalf.
Leapp manages different access methods:
IAM Users, IAM Roles federated with multiple Identity Providers (G Suite, Okta, and OneLogin at the time), IAM Role Chained to another AWS entity (the cross-account Role access thing), AWS Single Sign-On Roles, and Azure Subscriptions by now.
Leapp store securely information of the developers (like AWS Access Key and Secret Keys) and generate short-lived credentials accessible to any CLI, SKD, and external library.
The idea of the App is to provide the Cloud credentials I need only when required. Otherwise, the Cloud Credentials file is cleaned and not accessible to any attackers.
We integrate the project with specific services like AWS Single Sign-On, the automatic provisioning of the account available to access, and AWS System Manager Session Manager to access EC2 instances directly from the App.
I'm also finalizing the Access to other Cloud providers (Google Cloud Platform and Alibaba Cloud) in the following months.
Hundreds of developers are downloading it, and the most common reaction is: "It's addictive. I don't want to go back to anything else."
After all those requests, from today, we will help the company-wide adoption of the project with enterprise support of the open-source project.
https://www.leapp.cloud/support https://www.leapp.cloud/support
- jamesvnz 5y agoI happily stumbled across Leapp a few months ago - such an improvement for AWS SSO. Really looking forward to GCP support when it's ready.
- andreacavagna 5y agoWe are almost close to support GCP with the new core business logic of the Leapp Daemon: https://github.com/Noovolari/leapp-daemon https://github.com/Noovolari/leapp-daemon in the next releases we will move the business logic from electron to here. The Electron App and a CLI will communicate with the Leapp Daemon. Btw, the daemon is close to manage GCP and Alibaba Cloud Sessions!
- atonse 5y agoI use aws-vault and the best feature (apart from storing in your keychain, etc), is the fact that you can execute commands with the tokens in a shell environment it launches (aws-vault exec my-profile -- some-command-which-gets-the-aws-env-vars.sh) . That way we never even have to store the temporary credentials on the filesystem unencrypted.
- andreacavagna 5y agoWe are going to implement a custom credentials process for AWS too with the Leapp Daemon, it's in the roadmap of the project. Thanks for pointing it out. The main difference is that Leapp also disable the profiles whenever they are not needed, so attackers can't find even the credential process attached to a not in use profile. The main idea is to bring only the least credentials needed in order to make developers work. check specification for an in-depth explaination: https://github.com/Noovolari/leapp/wiki/specs https://github.com/Noovolari/leapp/wiki/specs