With the YubiKey’s support for RFC 6238 TOTP tokens (the same type of time-based one-time token that AWS uses) we can make this a much smoother process by adding some functions to our shell startup file. from an authenticator app on your phone) and type it in to the terminal each time you want to authenticate using MFA. Also, it requires you to look up a code (e.g. Typically this requires the person performing operations on AWS to provide a one-time code when they authenticate to AWS, as well as their more permanent password (for the web console) or their Access Key (for the CLI and SDKs).Īlthough the AWS CLI supports MFA authentication to temporarily assume roles, it doesn’t currently support using MFA authentication with IAM user credentials. If you’re working with Amazon Web Services, and want the highest level of security around usage of your AWS account, AWS recommends that you use IAM users instead of the account’s root user, set up Multi-Factor authentication (MFA) on the IAM users, and then require MFA for API operations. Simple and secure, storing each secret in a gpg encrypted file.Tags: aws Making life easier with Yubikeys and the AWS CLI
My solution uses pass to store credentials encrypted, physical access to a Yubikey to decrypt them, a tiny custom bash script, and the aws cli external process utility.įirst up, I use pass to store my passwords and secrets (and other stuff). What I came up with, I think, provides a good level of security without too much overhead. I wanted to something a little more secure than plain text aws_access_key_id and aws_secret_access_key in ~/.aws/credentials. So why is keeping AWS command line credentials in ~/.aws/credentials so common? Probably because setting up anything more secure adds a disproportionate level of complexity, when what you really want is get on with the fun stuff, developing. You shouldn’t keep credentials in plain-text, right? (Hint: the answer is no, you shouldn’t). Secure your AWS Credentials | Tony Wolski Tony Wolski Secure your AWS Credentials
0 kommentar(er)
