Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Documentation] Security page recommends using IAM Users, which conflicts with current IAM recommendations #4089

Open
jmsgwd opened this issue Apr 19, 2024 · 3 comments · May be fixed by #4100
Open

[Documentation] Security page recommends using IAM Users, which conflicts with current IAM recommendations #4089

jmsgwd opened this issue Apr 19, 2024 · 3 comments · May be fixed by #4100
Labels
documentation This is a problem with documentation. feature-request This issue requests a feature. needs-review p2 This is a standard priority issue

Comments

@jmsgwd
Copy link

jmsgwd commented Apr 19, 2024

Describe the issue

The security page in the documentation currently says:

To increase the security of your AWS account, we recommend that you use an IAM user to provide access credentials instead of using your AWS account credentials.

This is somewhat out-of-date and conflicts with the latest IAM best practices, which recommend using federated authentication with MFA (for human identities) and IAM roles with temporary credentials (for machine identities). Machine identities running outside AWS are a bit less straightforward, but even then there are options to avoid the use of IAM Users with long-term credentials - e.g. IAM Roles Anywhere allows use of X.509 client certificates to obtain temporary IAM credentials.

Links

https://boto3.amazonaws.com/v1/documentation/api/latest/guide/security.html
@jmsgwd jmsgwd added documentation This is a problem with documentation. needs-triage This issue or PR still needs to be triaged. labels Apr 19, 2024
@tim-finnigan tim-finnigan self-assigned this Apr 19, 2024
@tim-finnigan tim-finnigan added the investigating This issue is being investigated and/or work is in progress to resolve the issue. label Apr 19, 2024
@tim-finnigan
Copy link
Contributor

Thanks @jmsgwd for pointing this out. I agree that the wording in that documentation needs an update regarding the current IAM recommendations. I'll bring this issue up for discussion with the team and we should be able to get a PR up next week to address this.

@tim-finnigan tim-finnigan added feature-request This issue requests a feature. p2 This is a standard priority issue and removed investigating This issue is being investigated and/or work is in progress to resolve the issue. needs-triage This issue or PR still needs to be triaged. labels Apr 19, 2024
@tim-finnigan
Copy link
Contributor

Pinged @shepazon for feedback on this. I think the Boto3 security documentation page (corresponding file here) should include a link to the IAM best practices and generally defer to the IAM docs as they evolve.

@tim-finnigan tim-finnigan removed their assignment Apr 24, 2024
@tim-finnigan tim-finnigan linked a pull request Apr 25, 2024 that will close this issue
Open
@tim-finnigan tim-finnigan self-assigned this Apr 30, 2024
@tim-finnigan
Copy link
Contributor

Created PR linked above (#4100) that is pending team review.

@tim-finnigan tim-finnigan removed their assignment May 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
documentation This is a problem with documentation. feature-request This issue requests a feature. needs-review p2 This is a standard priority issue
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Update IAM references tim-finnigan/boto3
2 participants
@jmsgwd @tim-finnigan