FeatureFuel
1

S3 uploads should support ECS Task Roles / IAM Instance Roles

Source: outline/outline#4431 · opened by @nbryant42
Security-related feature request - ECS Task Roles / IAM Instance Roles [AWS S3 Upload]( authenticates to S3 via a statically configured AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY key pair. This authentication mechanism has basically been deprecated for several years now due to the _security drawbacks_: • Shared secrets must be carefully secured • Secrets must be rotated every 90 days to comply with a typical security policy, making it an uncomfortable proposition to deploy Outline at an organization that enforces a security policy. The preferred approach is to use ECS task roles or IAM instance roles (in that order) due to the _security advantages_: • Zero trust - shared secrets do not need to be configured at all • An ECS task, or process running on a bare EC2 instance, authenticates to AWS by first retrieving an ephemeral AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY key pair from one of two service endpoints. These pairs are periodically automati…

No pledges yet. Be the first to back this.

Make a pledge

Pledge your monetary support if this feature is added.

$

Comments

No comments yet.

Replying to

Add a comment

What do you think about this feature request?


Similar requests