3 ms·
Regular individual systems that run the code inside the AWS generally do not have long-lived tokens. The credentials are ultimately _pushed_ to the systems runn
by cyberax 1y ago
Regular individual systems that run the code inside the AWS generally do not have long-lived tokens. The credentials are ultimately _pushed_ to the systems running the services by a small set of highly secured and monitored privileged systems.
You get to see that even with the regular public AWS/EC2. Instance roles are managed externally from the customers' points of view.
- otabdeveloper4 1y ago> highly secured and monitored privileged systems So, ultimately "keys to the castle" aka a long password?
- cyberax 1y agoIt's a bit more complicated :) There are HSMs and code signing thrown into the mix. They went into total overengineering mode when designing it. But ultimately, any realistic design will eventually have systems that have to be trusted. It's just a question of isolating them.