Re:Static IPs for Serverless Containers
by sofixa on Monday December 02, 2024 @06:01PM
(#42301285)
JWT/OIDC, where the thing you're authenticating to (like MongoDB Atlas) trusts your identity provider (AWS, GCP, Modal, GitLab CI). It's better than mTLS because it allows for more flexibility in claims (extra metadata and security checks can be done with arbitrary data provided by the identity provider), and JWTs are usually shorter lived than certificates.
[ Parent
| on HN ]
We have a native OIDC integration at Modal, as well! Every container gets a token. https://modal.com/docs/guide/oidc-integration
Re:Static IPs for Serverless Containers
by fusjdffddddddds on Monday December 02, 2024 @09:45PM
(#42302648)
Based.
Awesome, great for you. OIDC/JWT for cross-stuff auth should become the norm.
How do you allow a driver using that exactly?
A db connection driver? You pass the JWT as the username/password which contains the information about your identity and is signed by the identity provider that the party you're authenticating to has been configured to trust.
Or, you use a broker like Vault to which you authenticate with that JWT, and which generates a just in time ephemeral username/password for your database, which gets rotated at some point.