Earlier quoted context omitted.
The AWS/IAM secrets wouldn't be passed around, except on initial creation.. Not sure what you mean? The problem they are fighting is host-level SSH authentication. Developers tend to have SSH keys stored all over the place, and it's near impossible to know if they protected their private keys with a password, or if they ever accidentally published them (how many private keys can you find on github these days? Using c…
Author of the blog post here. You totally nailed it about the problems with SSH keys. I think what zokier is referring to is that the BLESS client uses an AWS IAM role to authenticate users, so if you wanted to invoke it directly from an end-user machine they would need their AWS credentials on disk there. Instead BLESS seems to be intended to be invoked from a jump host which has a machine role giving it access to t…
Some tools to make the process easier: https://github.com/remind101/assume-role https://github.com/trek10inc/awsume