1

I am creating shortlived users on AWS on the fly and while debugging why these newly created logins tended to fail with an InvalidAccessKeyId realised that just adding a small sleep solved the problem.

xref How long should I wait after applying an AWS IAM policy before it is valid? re: time for consistency throughout AWS

My follow up question to the above: is there a way to synchronously create a consistent IAM policy? Or at least a way to know they are ready to use?

salient
  • 2,316
  • 6
  • 28
  • 43
  • 1
    If your workflow is 'create an IAM resource then attempt to use it' rather than 'update an IAM resource then use it' then perhaps you could simply change your client code to implement exponential backoff/retry up to a certain number of retries. That way you could seamlessly retry for certain failure responses, e.g. invalid key or resource not found. – jarmod Jun 03 '17 at 14:14
  • 4
    Neither of those things is possible, but why are you creating short-lived IAM users? There's a mechanism for handling short-lived credentials, called [Security Token Service (STS)](http://docs.aws.amazon.com/STS/latest/APIReference/Welcome.html), which should not require propagation/replication time, since the token appears to be self-contained. – Michael - sqlbot Jun 03 '17 at 23:22

1 Answers1

2

Amazon IAM is not designed for providing short-lived credentials. You should create IAM Users for long-lived requirements, such as logins for humans and logins for persistent applications.

An IAM User should not be used for application login purposes. For example, if you are creating an Instagram-like application, you should maintain your own database of users or utilize Amazon Cognito for user authentication.

So, how do you then grant users access to AWS resources? For example, if you have an Instagram-like application and you wish to grant application users the ability to upload/download their pictures in Amazon S3 but want to restrict access to a certain bucket and directory?...

The answer is to create temporary credentials using the AWS Security Token Service (STS). Credentials can be created with a given policy for a specific period of time. These credentials work immediately. For example, if an Instragram-like user logs into the app, the backend app could generate temporary credentials that allow the user to access a specific directory within a specific Amazon S3 bucket for a set period of time (eg 15 minutes). These credentials are then passed to the mobile app/web browser for direct access to AWS services.

John Rotenstein
  • 241,921
  • 22
  • 380
  • 470
  • Thanks, I'll look into STS. We are using Hashicorps Vault to manage credentials, and for other stuff like db and so on it's a very simple pattern to just generate new users with a certain TTL in the first place – salient Jun 04 '17 at 09:17