How to get aws credentials? - Githubissues

candide-guevara / btrfs_to_glacier

Makes periodic snapshots of my btrfs volumes and upload them to Glacier.

GNU General Public License v2.0

0 stars 1 forks source link

How to get aws credentials? #7

Closed candide-guevara closed 1 year ago

candide-guevara commented 1 year ago

Problem

No plain text AWS secret keys should be stored (ex: ~/.aws/credentials).
Always run using the least privileged IAM user, except for admin operations.
Should we rely on ~/.aws/config or the application config should be standalone?
Should we have different passwords for keyring and IAM users?

Solution

Add all credentials encrypted to the application config (will not use ~/.aws/config)
- Each user may have different password but they will be cached by gpg-agent.
Call gpg to decrypt the credentials using https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/credentials/processcreds#NewProvider

candide-guevara commented 1 year ago

gpg-agent interface is too limited cannot set a custom prompt for each type of password. Opted instead to have everything in the configuration encrypted.