3 ms·
Instance profiles (credentials) are accessible to all users for the life of the instance. Until AWS provides an ability to lock down portions of instance metada
by jamiesonbecker 12y ago
Instance profiles (credentials) are accessible to all users for the life of the instance. Until AWS provides an ability to lock down portions of instance metadata and/or a way to delete early in the boot process, it's much safer to bake your bootstrap key directly into the AMI as root (or specific user) visible only.
- zwily 12y agoYeah, perhaps as an additional block device you can mount with whatever permissions you want.
- jamiesonbecker 12y agoright on, like the FUSE in question.. but securely mounting something remotely means storing a bootstrap key somewhere anyway. Turtles all the way down :)
- toomuchtodo 12y agoGood point. I've been using IAM roles to bake the AMIs with Packer, where the key is fetched during the bake process; perhaps I'll investigate sneaker if there's time tonight. Thanks for rubber duckying this with me!