Skip to content

Blog

  • in AWS
  • 1 min read

No need for AWS IAM users

It's long been considered "best practice" to avoid having IAM users in AWS. Where possible IAM roles are preferable as role session credentials are short-lived. As far as I can tell, the only justification for AWS IAM users that I hear nowadays is for usage on non-interactive systems outside of AWS (so AWS SSO won't work), e.g. a Raspberry Pi in your closet.

I created a proof-of-concept project cloudkey to show that even that scenario can avoid IAM users. It uses the little-known iot:AssumeRoleWithCertificate functionality to avoid that.

  • in AWS
  • 3 min read

Two approaches to cross-account EventBridge

Since November 2020, EventBridge has supported two methods of creating cross-account event subscriptions. Both require a level of indirection in the form of an "intermediary" bus in the subscriber's account. Here are examples of how they work. We will refer to the account whose bus has interesting events as account B. We will refer to the subscriber account as account S.

  • in AWS
  • 1 min read

AWS SigV4 caching

Say you find yourself doing silly things with AWS APIs on a lazy Sunday afternoon. And you are getting an inexplicable error when using perfectly valid credentials.

  • in AWS
  • 2 min read

Nested Express Step Functions

AWS Step Functions are cool. Express Step Functions have always felt like they had the potential to be cool, but were missing some key features when they launched. I think they're worth revisiting in light of recent releases.

AWS federation comes to GitHub Actions

At the time of writing, this functionality exists but has yet to be announced or documented. It works, though!

EDIT: Here is the functionality on the GitHub roadmap.

GitHub Actions has new functionality that can vend OpenID Connect credentials to jobs running on the platform. This is very exciting for AWS account administrators as it means that CI/CD jobs no longer need any long-term secrets to be stored in GitHub.

  • in AWS
  • 5 min read

AWS Lambda $LATEST is dangerous

AWS Lambda has supported function versions since October 2015, only a couple of months after the service itself was publicly launched. Versions are an optional feature - you can develop and use Lambda functions without versioning, in which case you are working with the implicit $LATEST version.