对AWS账户标识符影响 [英] Impact of AWS Account Identifiers

问题描述

我使用亚马逊的工具来构建Web应用程序。我很高兴和他们在一起，但我有一个安全问题。

I'm using Amazon's tools to build a web app. I'm very happy with them, but I have a security concern.

现在，我使用多个EC2实例，S3，SimpleDB的和SQS。为了请求进行身份验证，以不同的服务，你有你的<一个href="https://aws-portal.amazon.com/gp/aws/developer/account/index.html?ie=UTF8&awscredential=&action=access-key"相对=nofollow>访问标识符（需要登录）。

Right now, I'm using multiple EC2 instances, S3, SimpleDB and SQS. In order to authenticate requests to the different services, you include your Access Identifiers (login required).

例如，从一个EC2实例文件上传到S3，您的EC2实例需要有您的访问密钥ID 的和你的访问密钥的

For example, to upload a file to S3 from an EC2 instance, your EC2 instance needs to have your Access Key ID and your Secret Access Key.

这基本上意味着你的用户名和密码，需要在你的情况。

That basically means your username and password need to be in your instances.

如果我的实例中的一个被攻破，我所有的亚马逊资产将受到影响。该键可用于上传/更换S3和SimpleDB的数据，启动和停止EC2实例，等等。

If one of my instances were to be compromised, all of my Amazon assets would be compromised. The keys can be used upload/replace S3 and SimpleDB data, start and stop EC2 instances, etc.

我怎样才能最大限度地降低单个受损主机的损害？

How can I minimize the damage of a single compromised host?

我首先想到的是让每个帐户多个标识符这样我就可以跟踪所做的更改并迅速撤销了黑客的帐户。亚马逊不支持多组的每个帐户凭据。

My first thought is to get multiple identifiers per account so I can track changes made and quickly revoke the 'hacked' account. Amazon doesn't support more than one set of credentials per account.

我的第二个想法是创建多个帐户，并使用访问控制列表的控制访问。不幸的是，并非所有的服务提供支持授予其他帐户访问您的数据。以上的带宽是便宜你用的越多，所以有这一切都要经过一个帐户是理想的。

My second thought was to create multiple accounts and use ACL's to control access. Unfortunately, not all the services support granting other accounts access to your data. Plus bandwidth is cheaper the more that you use, so having it all go through one account is ideal.

有没有人处理，或者至少想过这个问题？

Has anyone dealt with, or at least thought about this problem?

推荐答案

AWS，您可以创建多个用户提供身份和访问管理。这将允许你实现任何你的场景。

AWS allows you to create multiple users with Identity and Access Management. This will allow you to implement either of your scenarios.

我会建议定义每个EC2实例的IAM用户，这可以让你取消访​​问特定用户（或只是他们的快捷键），如果相应的EC2实例被泄露，还可以使用细粒度的权限来限制什么的API用户可以调用什么资源他们可以访问（例如，只允许用户上传到一个特定的桶）。

I would suggest defining an IAM user per EC2 instance, this allows you to revoke access to a specific user (or just their access keys) if the corresponding EC2 instance is compromised and also use fine-grained permissions to restrict what APIs the user can call and what resources they can access (e.g. only permit the user to upload to a specific bucket).

这篇关于对AWS账户标识符影响的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！