datawire / loom

Loom enables operations engineers to provide a self-serve Kubernetes provisioning experience for developers
http://loom.run
Apache License 2.0
52 stars 5 forks source link

Switch to STS GetCallerIdentity rather than using IAM GetUser to acquire AWS account ID #19

Open plombardi89 opened 7 years ago

plombardi89 commented 7 years ago

The IAM GetUser call requires additional IAM permissions for users that the STS call does not require therefore the less friction-y approach for getting this information is to rely on the STS service to acquire the credentials.

This issue was discovered during some on-site user testing where we learned that the AWS credentials some users were issued by their AWS admin did not have the necessary IAM permissions thus requiring the admin to begrudgingly modify their AWS accounts permissions to proceed.