Join Log in
Score:0
Loc12342 avatar Server

Prevent EC2 User from Seeing AWS Secrets and Credentials

cn flag
Loc12342

Preface:

I use a windows EC2 instance with a role attached that allows it access to specific AWS Secrets Manager secrets. We never use access keys directly. The app running on the instance needs to be able to pull these secrets.

The end-user of this instance is currently required to RDP into that instance in order to perform their task. The end user is never directly aware that they can access the secrets manager secrets, but it's possible.

The end-user is accessing a CLI app and a website that runs locally on the EC2 machine.

Problem:

Since the instance has a role that allows it to see secrets, the end-user can use the AWS cli or curl etc while in an RDP session to retrieve secrets that they weren't supposed to be able to directly access.

Question:

How do I prevent the end-user from being able to access secrets, while allowing the instance the freedom it needs to perform its function? Is there something that can be done in terms of user permissions on the instance? Any alternative solutions?

29
0 + 0
rdp
Tim avatar
gp flag
Tim
I'm not sure you can prevent the user accessing anything the instance role permits. You might have to see if there is some kind of Windows user level control to prevent this. Otherwise you may have to prevent them RDPing onto the machine.
0
Reply
cn flag
shearn89
Other than using windows controls to prevent the user running the AWS CLI or any SDKs, I'm not sure this is possible.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.