News for hackers. Stuff that matters.

A comment on Billion-record stolen Chinese database for sale on breach forum. Parent comment

Re:Billion-record stolen Chinese database for sale on breach... by rad_gruchalski on Tuesday July 05, 2022 @06:17PM (#31994456)
I like your approach. So far I used profiles extensively. AWS_PROFILE is your friend. No idea why AWS doesn't heavily promote this everywhere they can.
[ Parent | on HN ]
Re:Billion-record stolen Chinese database for sale on breach... by flyt on Tuesday July 05, 2022 @07:29PM (#31995006)
AWS best practices is to use AWS SSO, which accomplishes this same effect but without any long-lived local credentials. It works really well.
[ Parent | on HN ]
Re:Billion-record stolen Chinese database for sale on breach... by LilBytes on Tuesday July 05, 2022 @08:45PM (#31995517)
Depending on your IdP there's a few tools in addition to AWS CLI v2 that works well in this space.

aws-vault is one of them, though out of support now, aws-okta [1] is another.

[1] https://github.com/segmentio/aws-okta

[ Parent | on HN ]
Re:Billion-record stolen Chinese database for sale on breach... by nijave on Tuesday July 05, 2022 @11:10PM (#31996258)
Used to use that a few years ago and it worked pretty well--you can also set it as a credential helper in your AWS config.

Just an FYI it's no longer supported and it looks like the fork has gone stagnant, too.

[ Parent | on HN ]
Re:Billion-record stolen Chinese database for sale on breach... by arjvik on Tuesday July 05, 2022 @07:25PM (#31994987)
> No idea why AWS doesn't heavily promote this everywhere they can.

Not Invented Here

[ Parent | on HN ]
Re:Billion-record stolen Chinese database for sale on breach... by moduspol on Tuesday July 05, 2022 @08:33PM (#31995436)
AWS SSO solves it better, and for any number of AWS accounts.

I still use aws-vault, though, when I'm not in a position to set up AWS SSO.

[ Parent | on HN ]