5 ms·

One major highlight: "The console provides access via your Amazon username and password. No more certificates or public/secret keys to manage"

• delano 18y ago
  This seems like a really bad idea to me.
  • mdasen 18y ago
    I'd be inclined to agree except that anyone with your Amazon email/pass already has access to your public/secret keys. So, it's not much of a security hole since a person with your account details could simply log in and grab your keys. Still, it would be nice if Amazon offered a "high security" option that didn't trust password authentication and couldn't re-give you your secret key. I probably wouldn't use it, but it's still a good thing to offer.
    • timf 18y ago
      > "a "high security" option that didn't trust password authentication and couldn't re-give you your secret key" And no way to reset it? What if you have VMs currently running that need to be stopped ($$)? And if there's a reset then it's the same thing as your point, anyone with your password has access (unless you're thinking email but that's worse than the current https delivery of secret keys IMO). I like the idea in spirit. I also think they would do well with a delegation of rights model (that included limited delegation). Any of these portals (Rightscale etc.) need you to upload your full credentials for anything to work.