Security

Thanks to reader Ewout and his comment on my article How to Keep Your AWS Credentials on an EC2 Instance Securely for suggesting an additional method of transferring credentials: via a snapshot. It’s similar to burning credentials into an AMI, but easier to do and less prone to accidental inclusion in the application’s AMI. Read on for a discussion of how to implement this technique. How to Store AWS Credentials on an EBS Snapshot This is how to store a secret on an EBS snapshot. You do this only once, or whenever you need to change the secret. ...

If you’ve been using EC2 for anything serious then you have some code on your instances that requires your AWS credentials. I’m talking about code that does things like this: Attach an EBS volume Download your application from a non-public location in S3 Send and receive SQS messages Query or update SimpleDB All these actions require your credentials. How do you get the credentials onto the instance in the first place? How can you store them securely once they’re there? First let’s examine the issues involved in securing your keys, and then we’ll explore the available options for doing so. ...