4 ms·
I was one of those people bitten by this last night. My client called and told me he was getting access denied when trying to upload files through his CMS. Afte
by joshchaney 13y ago
I was one of those people bitten by this last night. My client called and told me he was getting access denied when trying to upload files through his CMS. After some digging I found the S3 key had been revoked. This was concerning, as I hadn't touched the CMS code I wrote in like 3 years and I've had issues deploying old stuff to Heroku in the past. I really wish MongoHQ had contacted me first about revoking the keys.
- muns 13y agoBest practice would be to create an IAM user for each purpose rather than sharing the same AWS key across all of your apps, for this exact reason
- danial 13y agoYes, for this reason, and because having separate keys allows you set appropriate access controls limited to the function they are being used for.
- joshchaney 13y agoAt the time this project was put together, IAM didn't exist. But I agree that this would be the best approach going forward.
- mrkurt 13y agoWe're very sorry about this, we went into a little bit of a panic when we realized that we held IAM credentials that gave full access to peoples' EC2 accounts and did what we thought was best. In hindsight, we should have gotten ahold of Amazon immediately and let them manage that process.