4 ms·

I don’t know why you’re getting downvoted, because you’re completely right. Perhaps people are reading your comment as “credential leakage doesn’t decrease secu

• traceroute66 4y ago
  > but that doesn’t seem to be what you’re saying Indeed I'm not. To spell it out, what I'm saying is.... People should be working on the assumption that their IAM credentials WILL be leaked and work back from there. That leak may be accidental on Github, it may be via a hack, you might have accidentally pasted it into an email, it doesn't matter, the mechanism of leak is irrelevant. Blast radius / Attack surface / Layered security ... whatever your choice of words, that's what you need to do and that's what AWS IAM gives you the tools to do. As I've previously said, its really not that much effort to add the extra layers of security (e.g. you can start with easy stuff, low-hanging fruit like IP/Time constraints and then move onto more advanced stuff later). Infact I'd argue the detractors here who have been busy downvoting me and arguing against me could have put a lot of extra security on their IAM credentials in the same timeframe. ;-)
  • bagels 4y ago
    It takes a few seconds to respond to your comments. I takes days to implement all of the items that someone may have never even heard of on your list.