> Leakage of credentials sure has led to quite a few compromises.
No.
As per my post above, they "led to compromise" because lazy syadmins have been too inept to RTFM and make full use of IAM.
I mean, I could post my IAM credentials right here. I've even been lazy and haven't rotated them for 5 years (yes I've already slapped myself on the wrist !).
But they'll be naff all use to you because:
- My credentials are deactivated when I'm not using them.
- The STS policies they are linked to are IP-restricted
- The Role policies they are linked to are also IP-restricted
- The Role policies have minimal necessary privilege
- The Role policies can only be invoked be an assumed role
- The Roles have externalID attribute set using a UUID as value
Thus even if I copy/pasted my credentials right here, you wouldn't even get past step 1 let alone any further.
And that's just a simple example. You can go much more layered and granular than that.
Its not rocket science, its not difficult, its just a case of the old PPPPPP (Prior Planning Prevents P* Poor Performance).
No.
As per my post above, they "led to compromise" because lazy syadmins have been too inept to RTFM and make full use of IAM.
I mean, I could post my IAM credentials right here. I've even been lazy and haven't rotated them for 5 years (yes I've already slapped myself on the wrist !).
But they'll be naff all use to you because:
Thus even if I copy/pasted my credentials right here, you wouldn't even get past step 1 let alone any further.And that's just a simple example. You can go much more layered and granular than that.
Its not rocket science, its not difficult, its just a case of the old PPPPPP (Prior Planning Prevents P* Poor Performance).