Show HN: AWS credentials management CLI tool
1–10 of 21 posts
Re: Show HN: AWS credentials management CLI tool
#2Why use this over aws-vault
Re: Show HN: AWS credentials management CLI tool
#3I always wonder why people are investing so much energy and time to invent New tools instead oft using existing tools that already solve the same issues.
Just use ansible for that.
Re: Show HN: AWS credentials management CLI tool
#4Why use this over aws-vault
Also a aws vault user here. https://github.com/99designs/aws-vault
Re: Show HN: AWS credentials management CLI tool
#5In my company everything goes through Active Directory and we use saml2aws [1] to generate credentials with two factor involved. It works quite well for us. We even use this for our artists to create local builds of our games since we keep all important secrets and such in aws secrets mananger. We scope access to said secrets with custom roles and tags.
Re: Show HN: AWS credentials management CLI tool
#6I always wonder why people are investing so much energy and time to invent New tools instead oft using existing tools that already solve the same issues. Just use ansible for that.
Yeah, and reinvent them in Node.js!
Re: Show HN: AWS credentials management CLI tool
#7In my company everything goes through Active Directory and we use saml2aws [1] to generate credentials with two factor involved. It works quite well for us. We even use this for our artists to create local builds of our games since we keep all important secrets and such in aws secrets mananger. We scope access to said secrets with custom roles and tags. [1] https://github.com/Versent/saml2aws
We do the same, through Google Workspace. saml2aws has a propensity to randomly break (probably Google's fault, as saml2aws scrapes the login pages) but it's "good enough".
Quoting original link:
> The regular approach taken by many software companies is either:
> Using expensive SSO solutions (3rd party single sign-on SaaS platforms) and writing custom CLI toolkits for integrating with said platforms for programmatic AWS access (early and unnecessary complexity, financial and development time costs). > Or not using any MFA at all and just using plain permanent AWS IAM user credentials (terribly insecure).
saml2aws is open-source code that anybody can use and contribute to, and can be used off-the-shelf. Google Workspace is "free" in that we were already using it and paying for it. Meanwhile the approach asked for in the parent, with a hub and spoke model, requires long-lived IAM users in the hub account that need to be managed separately from the company's SSO directory and thus violates SSO principles.
Re: Show HN: AWS credentials management CLI tool
#8The code is very nicely done. I don't use AWS currently but I stared it on GitHub.
Re: Show HN: AWS credentials management CLI tool
#9I'm not sure I see the benefit of this over using the built-in functionality of AWS SSO[1] which is built into AWS and integrates with Control Tower.
If you want to use it's internal iDP - you can. If you want to authenticate against GSuite or another SAML provider, you can do that, too.
Re: Show HN: AWS credentials management CLI tool
#10This looks cool, i will give it a try.