5 ms·

This is neat, although it throws a wrench into my recent move encrypt my AWS secret access key with my TPM to prevent the key from being used anywhere besides m

This is neat, although it throws a wrench into my recent move encrypt my AWS secret access key with my TPM to prevent the key from being used anywhere besides my laptop[0]. [0]: https://github.com/psanford/awsv4signer/tree/main/examples/tpmsigner https://github.com/psanford/awsv4signer/tree/main/examples/t...

gnabgib 5y ago
The article is vague (no link to docs, no formula, no block diagram), but it seems to say the fundamental process still runs via a pre-shared-secret. That is secret you're trying to secure, and one that AWS knows. However, that secret is no longer used for the signing. Instead it's combined with a date and service-description to generate a public-private keypair, which is itself not secret (both AWS and you can derive this if you know the algorithm). Your requests are now signed with this private key (client side) and can be verified by the services with the public key (server side). AWS still knows your secret, but it keeps it in a more secured location verses out on the farms. The farms would need a way to request your public key for the day from the secured location, so they can verify the sender. But, the farms no longer have access to your secret key, so cannot sign other requests masquerading as you.
- psanford 5y ago
  If the ECDSA key pair is still derived using an hmac keyed by the private key, I can do that with the key loaded in the tpm. Otherwise it is unlikely to work with my current setup. Once the key is loaded into the TPM as an HMAC key, you can no longer get the plaintext key back out. You have to use the TPM to perform any HMAC operations using the key.
twistedpair 5y ago
Feels odd that AWS still uses secret tokens all these years later. Take GCP for example. They use your personal identity (via OAuth, service accounts use certs), and you can use FIDO tokens to authenticate your local keys (e.g. for gcloud CLI). I was very surprised to see that awscli still doesn't support Yubikeys.
- jffry 5y ago
  I'm a big fan of aws-vault [1], which helps securely store your tokens and use them to obtain temporary credentials which are time-limited and constrained to a specific IAM role. It's not as good as having something that supports a hardware token, of course, but it's better than the default awscli suggestion to keep the secrets around in plaintext either on disk or in env vars. [1] https://github.com/99designs/aws-vault https://github.com/99designs/aws-vault
  - tptacek 5y ago
    aws-vault is one of the standard answers for this problem, and once you have it set up, the ergonomics are in some ways superior to that of manually managed AWS secrets. Highly recommended.
- deleted 5y ago
  [deleted]
- moltar 5y ago
  You can use SSO with aws-vault
  - 0xbadcafebee 5y ago
    Or, use saml2aws with your system keychain (pass/gpg for headless systems) and don't use aws-vault at all. With the credential_process option to AWS CLI, you don't even ever need to re-authenticate, as the AWS CLI will call saml2aws, which will use your keychain-stored SSO credentials, and automatically refresh your AWS temporary session.
- OJFord 5y ago
  > I was very surprised to see that awscli still doesn't support Yubikeys. Singular it does, per IAM user.
  - drodgers 5y ago
    But only for the web console, not via the CLI. The API for generating short-term keys (which aws-vault uses) only supports TOTP, not FIDO/U2F/WebAuthn. https://github.com/aws/aws-cli/issues/3607 https://github.com/aws/aws-cli/issues/3607
timmattison 5y ago
We actually just did a livestream today at AWS about how to store a credential in an HSM to avoid having IAM credentials in clear text. You can see it here - https://www.twitch.tv/aws/video/1156973272 https://www.twitch.tv/aws/video/1156973272 We haven’t released the code yet but are in the process. If you think this could work for you or you’d just like to see how we did it DM me on Twitter @timmattison and I’ll give you the code ASAP.
- psanford 5y ago
  Neat! An HSM sounds like way overkill for a developer machine, but I could see that being useful for other use cases. The TPM is a good option because every non-Mac ships with one already (and there are similar facilities available on macs).
  - timmattison 5y ago
    In this case it was a Zymbit Zymkey 4i which contains a secure element with a bunch of additional functionality (tamper detection, etc) and works with a Raspberry Pi. Now I’m wondering how easily it could be adapted for use on a laptop with a TPM…
    - psanford 5y ago
      If you are looking for some references besides my linked code, this comment[0] on the tpm2-tools repo will probably be useful. FWIW, I've moved my workflow over to having long lived aws keys protected by my TPM and then I generate session credentials from that for normal aws cli usage. [0]: https://github.com/tpm2-software/tpm2-tools/issues/1597#issuecomment-889882601 https://github.com/tpm2-software/tpm2-tools/issues/1597#issu...
- bogomipz 5y ago
  I also have this exact use case however I'm not on Twitter. Is there another way to contact you or see the code? Thanks.
  - deleted 5y ago
zxcvbn4038 5y ago
I think this does the same thing - https://github.com/99designs/aws-vault https://github.com/99designs/aws-vault At least on MacOS it uses keychain. There are other storage backends for other platforms.
- psanford 5y ago
  Not quite. aws-vault still reads the secret out of the backend to create session credentials. You likewise could read the backend directly to get the credentials (assuming you are authenticated). With the secret stored in a tpm it cannot be extracted. Instead you ask the tpm execute the hmac() function on your behalf with the secret only it can read.

gnabgib 5y ago

The article is vague (no link to docs, no formula, no block diagram), but it seems to say the fundamental process still runs via a pre-shared-secret. That is secret you're trying to secure, and one that AWS knows. However, that secret is no longer used for the signing. Instead it's combined with a date and service-description to generate a public-private keypair, which is itself not secret (both AWS and you can derive this if you know the algorithm). Your requests are now signed with this private key (client side) and can be verified by the services with the public key (server side). AWS still knows your secret, but it keeps it in a more secured location verses out on the farms. The farms would need a way to request your public key for the day from the secured location, so they can verify the sender. But, the farms no longer have access to your secret key, so cannot sign other requests masquerading as you.

psanford 5y ago
If the ECDSA key pair is still derived using an hmac keyed by the private key, I can do that with the key loaded in the tpm. Otherwise it is unlikely to work with my current setup. Once the key is loaded into the TPM as an HMAC key, you can no longer get the plaintext key back out. You have to use the TPM to perform any HMAC operations using the key.

twistedpair 5y ago

Feels odd that AWS still uses secret tokens all these years later. Take GCP for example. They use your personal identity (via OAuth, service accounts use certs), and you can use FIDO tokens to authenticate your local keys (e.g. for gcloud CLI). I was very surprised to see that awscli still doesn't support Yubikeys.

jffry 5y ago
I'm a big fan of aws-vault [1], which helps securely store your tokens and use them to obtain temporary credentials which are time-limited and constrained to a specific IAM role. It's not as good as having something that supports a hardware token, of course, but it's better than the default awscli suggestion to keep the secrets around in plaintext either on disk or in env vars. [1] https://github.com/99designs/aws-vault https://github.com/99designs/aws-vault
- tptacek 5y ago
  aws-vault is one of the standard answers for this problem, and once you have it set up, the ergonomics are in some ways superior to that of manually managed AWS secrets. Highly recommended.
deleted 5y ago
[deleted]
moltar 5y ago
You can use SSO with aws-vault
- 0xbadcafebee 5y ago
  Or, use saml2aws with your system keychain (pass/gpg for headless systems) and don't use aws-vault at all. With the credential_process option to AWS CLI, you don't even ever need to re-authenticate, as the AWS CLI will call saml2aws, which will use your keychain-stored SSO credentials, and automatically refresh your AWS temporary session.
OJFord 5y ago
> I was very surprised to see that awscli still doesn't support Yubikeys. Singular it does, per IAM user.
- drodgers 5y ago
  But only for the web console, not via the CLI. The API for generating short-term keys (which aws-vault uses) only supports TOTP, not FIDO/U2F/WebAuthn. https://github.com/aws/aws-cli/issues/3607 https://github.com/aws/aws-cli/issues/3607

timmattison 5y ago

We actually just did a livestream today at AWS about how to store a credential in an HSM to avoid having IAM credentials in clear text. You can see it here - https://www.twitch.tv/aws/video/1156973272 https://www.twitch.tv/aws/video/1156973272 We haven’t released the code yet but are in the process. If you think this could work for you or you’d just like to see how we did it DM me on Twitter @timmattison and I’ll give you the code ASAP.

psanford 5y ago
Neat! An HSM sounds like way overkill for a developer machine, but I could see that being useful for other use cases. The TPM is a good option because every non-Mac ships with one already (and there are similar facilities available on macs).
- timmattison 5y ago
  In this case it was a Zymbit Zymkey 4i which contains a secure element with a bunch of additional functionality (tamper detection, etc) and works with a Raspberry Pi. Now I’m wondering how easily it could be adapted for use on a laptop with a TPM…
  - psanford 5y ago
    If you are looking for some references besides my linked code, this comment[0] on the tpm2-tools repo will probably be useful. FWIW, I've moved my workflow over to having long lived aws keys protected by my TPM and then I generate session credentials from that for normal aws cli usage. [0]: https://github.com/tpm2-software/tpm2-tools/issues/1597#issuecomment-889882601 https://github.com/tpm2-software/tpm2-tools/issues/1597#issu...
bogomipz 5y ago
I also have this exact use case however I'm not on Twitter. Is there another way to contact you or see the code? Thanks.
- deleted 5y ago

zxcvbn4038 5y ago

I think this does the same thing - https://github.com/99designs/aws-vault https://github.com/99designs/aws-vault At least on MacOS it uses keychain. There are other storage backends for other platforms.

psanford 5y ago
Not quite. aws-vault still reads the secret out of the backend to create session credentials. You likewise could read the backend directly to get the credentials (assuming you are authenticated). With the secret stored in a tpm it cannot be extracted. Instead you ask the tpm execute the hmac() function on your behalf with the secret only it can read.