News for hackers. Stuff that matters.

A comment on MongoHQ Security breach. Parent comment

Re:MongoHQ Security breach by muns on Tuesday October 29, 2013 @06:45PM (#6638054)
Best practice would be to create an IAM user for each purpose rather than sharing the same AWS key across all of your apps, for this exact reason
[ Parent | on HN ]
Re:MongoHQ Security breach by joshchaney on Tuesday October 29, 2013 @08:08PM (#6638492)
At the time this project was put together, IAM didn't exist. But I agree that this would be the best approach going forward.
[ Parent | on HN ]
Re:MongoHQ Security breach by danial on Tuesday October 29, 2013 @07:53PM (#6638420)
Yes, for this reason, and because having separate keys allows you set appropriate access controls limited to the function they are being used for.
[ Parent | on HN ]