Re: Proposed user handling in AWS
On Fri, Apr 05, 2019 at 12:21:25AM +0200, Bastian Blank wrote:
> We never filled the details for a possible user handling in AWS. I
> therefor like to propose the following:
>
> - All user management/sync will be bundled into one AWS account.
> - All user access to the publishing and engineering accounts will be via
> assumed roles (we might switch to SAML if it makes sense).
> - All "users" in the publishing and engineering acounts are automatic
> processes, like our upload stuff.
Technically, I think this sounds nice.
The automated "users" could also live in the management account and
assume role. This complicates automation, but ensures that the target
accounts are only access via ephemeral keys. Not sure if the extra step
is worth it.
Ross
Reply to: