3 ms·
You can use AWS IAM (https://aws.amazon.com/iam/ https://aws.amazon.com/iam/) to help prevent something like this. AFAIK you can create a sub-account that only
by matteotom 12y ago
You can use AWS IAM (https://aws.amazon.com/iam/ https://aws.amazon.com/iam/) to help prevent something like this. AFAIK you can create a sub-account that only has access to specific resources, such as S3, and use the keys from that sub-account.
I haven't used it much, but it looks like you can be very specific in what you allow, such as only allowing access to a single bucket with S3, or a single domain with SES.
- tekromancr 12y agoYou totally can be very specific about what actions and services an IAM key has access to. The permissions model takes a bit to get your head around (It did me, at least) but once you do, you can have very strict, precise permissions for your keys.
- stevekemp 12y agoYes that's correct. I use a specific key for only allowing DNS updates to be applied to "example.com" and no other domain, for example. As others have mentioned the billing alerts are also a useful thing, along with the IAM Simulator.