3 ms·
This is a good feature, but it seems now the temporary AWS access keys of the IAM role will be accessible to any application running on the EC2 instance, not ju
by kennu 14y ago
This is a good feature, but it seems now the temporary AWS access keys of the IAM role will be accessible to any application running on the EC2 instance, not just the one with the config files like before. I wonder if this will create any unexpected security issues? New kinds of trojans?
Also, I hope Boto (the Python AWS API) will support this soon.
- tszming 14y agoAnother concern is the EC2 Instance Metadata Service does not support SSL.
- jeffbarr 14y agoThis is true, but I'm not sure if I understand how SSL support for this would increase security since the request and the response go no further than our internal network.
- jimfl 14y agohttps://github.com/boto/boto/issues/811 https://github.com/boto/boto/issues/811
- donavanm 14y agoI think the philosophy is that the trust boundry is your host, not your uid. We seem to be migrating towards "one instance per application" from of the traditional "one uid/proc per application". For the great majority of use cases this is going to be the simpler, and safer assumption.