News for hackers. Stuff that matters.

A comment on Show HN: I built open source file sharing solution using AWS S3.

Re:Show HN: I built open source file sharing solution using ... by billev2k on Monday December 30, 2024 @11:19AM (#42550671)
I'm pretty leery of making the "access key" and "secret key" so public (like typing them into a web page, or setting them in environment variables). Of course it adds significant friction to set up an IAM identity for every user, and "low friction" is one of the key requirements here.
[ Parent | on HN ]
Re:Show HN: I built open source file sharing solution using ... by ryanianian on Monday December 30, 2024 @12:21PM (#42551310)
A "correct" implementation would give you a temporary IAM role or something (STS) based on a JWT or other authn mechanism.

This is not that difficult if you're already invested in an identity ecosystem, but a right pain without something to bootstrap it.

On the plus side, AWS creds can be made to be temporary and limited in scope to just the nouns/verbs required. Creating and vending those tokens is an exercise for the reader.

[ Parent | on HN ]
Re:Show HN: I built open source file sharing solution using ... by 420official on Monday December 30, 2024 @04:23PM (#42553707)
It really isn't that challenging to get going with JWT auth in AWS. Gitlab has pretty good documentation for how to use Gitlab ID tokens to assume roles that includes everything other than how to generate a JWT here: https://docs.gitlab.com/ee/ci/cloud_services/aws/

And of course generating OIDC PKI JWTs is pretty easy and well documented elsewhere.

The harder parts in my mind are:

  - Updating this OSS project to serve a JWK from OIDC .well-known
  - Convincing people that this method of authn is safe and that those keys are securely stored
[ Parent | on HN ]
Re:Show HN: I built open source file sharing solution using ... by rohitghumare on Monday December 30, 2024 @06:39PM (#42554846)
I completely Agree on this point. I have this in mind for implementation. For now, I'm focusing on bringing more cloud providers.
[ Parent | on HN ]