3 ms·
I don't undertsand why AWS insists on using network connections for security when there is a much better approach: virtual block device. Provide a tiny virtual
by theamk 3y ago
I don't undertsand why AWS insists on using network connections for security when there is a much better approach: virtual block device. Provide a tiny virtual block device, put filesystem on it, and generate credentials there, in json file format or even directly as sdk's ini file. If filesystem cache is a problem, put tar/cpio on block device directly and require equivalent of "tar xf /dev/vda".
This solves so much problems: security is trival (set file permissions), audit is trivial, no more timeouts, deciding whether to expose credentials to container or not is trivial (using directory sharing...), the client code is dramatically simplified.