Hacker News Reader

How are you dealing with software that expect to get aws tokens? Especially with sts AssumeRoles only lasting up to one hour?

For example, if you want to run the Athena JDBC driver locally or read something from S3 in a longish (>1h) running Python script.

View on HN

I can't answer for Segment, but our AWS account strategy is very similar, so we've found that there is still a need for a centralized KMS solution (system-to-system auth). Our teams are working on a project to wrap more tooling around Vault and make it a centralized KMS. T-Mobile has done some work on this... https://opensource.t-mobile.com/blog/posts/introducing-tvaul...

If you use aws-vault --server or something like it that mocks a metadata server, all the sdks handle rotation properly. Just need to fork to connect it to whatever generates tokens

Reply on news.ycombinator.com