1
S3 uploads should support ECS Task Roles / IAM Instance Roles
Source: outline/outline#4431 · opened by @nbryant42
Security-related feature request - ECS Task Roles / IAM Instance Roles [AWS S3 Upload]( authenticates to S3 via a statically configured AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY key pair. This authentication mechanism has basically been deprecated for several years now due to the _security drawbacks_: • Shared secrets must be carefully secured • Secrets must be rotated every 90 days to comply with a typical security policy, making it an uncomfortable proposition to deploy Outline at an organization that enforces a security policy. The preferred approach is to use ECS task roles or IAM instance roles (in that order) due to the _security advantages_: • Zero trust - shared secrets do not need to be configured at all • An ECS task, or process running on a bare EC2 instance, authenticates to AWS by first retrieving an ephemeral AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY key pair from one of two service endpoints. These pairs are periodically automati…
No pledges yet. Be the first to back this.
Comments
Similar requests
AWS IAm role support for S3 Access ?
1 vote · 0 comments
[Task Synchronization] - API / Webhook
2 votes · 0 comments
[Task Synchronization] - API / Webhook - Feature Request
2 votes · 0 comments
store s3 files under a subpath
2 votes · 0 comments
Task List / Task Checkboxes in Tables
9 votes · 0 comments
No comments yet.