News for hackers. Stuff that matters.

A comment on We didn't encrypt your password, we hashed it. Parent comment

Re:We didn't encrypt your password, we hashed it by t0astbread on Friday September 04, 2020 @07:10PM (#24379839)
Bookmarking this. Additionally I assume you could also limit access to KMS so that only your servers can issue requests.
[ Parent | on HN ]
Re:We didn't encrypt your password, we hashed it by hn_throwaway_99 on Friday September 04, 2020 @07:21PM (#24379911)
Yep. Not sure the details of AWS, but in GCP access to KMS APIs and specific keys is controlled by IAM, and you can set "conditions" on IAM policies to restrict access by things like IP of the request: https://cloud.google.com/iam/docs/conditions-overview
[ Parent | on HN ]
Re:We didn't encrypt your password, we hashed it by WrtCdEvrydy on Friday September 04, 2020 @08:56PM (#24380512)
KMS is managed by IAM so you can attach roles or use STS (create an access key / password) that can assume a role that can encrypt.
[ Parent | on HN ]