3 ms·

Because they're namespaced by which AWS account you connect to, same as Slack and many more enterprise products. You don't have an AWS account. You have an IAM

• ggm 5y ago
  I absolutely do think that reasonable ordinary people find this situation confusing. As do password managers. IAM identity is not exactly a widespread understood concept. I doubt if most people entirely "get" the distinction. Google (our instance) pretty much forbids crossbinding like this. I've had non google accounts refused as bootstrap identity in ads and gke because they were just used elsewhere on Google for authorising access. I'm reluctant to delete duplicate Amazon entries in 1password and bitwarden in case I still need them, for some distinct IAM.
  • scrollaway 5y ago
    You should be deleting IAM identities you do not use. At the source, not just from the password manager but actually deleting the accounts/secret keys/passwords/whatever. Also AWS isn't exactly for "reasonable ordinary people", it's a tool that requires some minimum amount of training. Yes the concept isn't super widely used for end user applications (although 1Password is a good example of another such "you have an account on an instance, that is unrelated to your account with the same email on another instance" concept). And yeah I do wish password managers would handle that better, but for anything that uses subdomain-level separation (example.1password.com vs amazon's signin.aws.amazon.com with multiple fields), it generally works out fine.