从CloudFormation AccessKey创建中安全地获取访问密钥/机密

Question

我创建了一个CloudFormation模板，它成功地创建了一个IAM用户和一个AccessKey，并将该AccessKey分配给IAM用户。现在，我通过在CloudFormation模板的outputs部分中输出AccessKey来获得AccessKey的秘密。

{
    "Description": "My CloudFormation Template",
    "Outputs": {
        "UserAccessKeyId": {
            "Description": "The value for the User's access key id.",
            "Value": {
                "Ref": "UserAccessKey"
            }
        },
        "UserSecretKey": {
            "Description": "The value for the User's secret key.",
            "Value": {
                "Fn::GetAtt": [
                    "UserAccessKey",
                    "SecretAccessKey"
                ]
            }
        }
    },
    "Resources": {
        "User": {
            "Properties": {
                "UserName": "myNewUser"
            },
            "Type": "AWS::IAM::User"
        },
        "PrimaryUserAccessKey": {
            "DependsOn": "User",
            "Properties": {
                "Status": "Active",
                "UserName": "myNewUser"
            },
            "Type": "AWS::IAM::AccessKey"
        }
    }
}

Answer 1

我建议把它保密。您可以让CloudFormation将值写入堆栈中的Secrets Manager，然后通过代码访问它。这让你有一个秘密，没有人必须看到或触摸才能使用它。

我想像这样的事情应该会奏效（注意：我实际上还没有尝试过）。

AccessKey:
  Type: AWS::IAM::AccessKey
  Properties: 
    Serial: 1
    Status: Active
    UserName: 'joe'

  AccessKeySecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: JoeAccessKey
      Description: Joes Access Key
      SecretString: !Sub '{"AccessKeyId":"${AccessKey}","SecretAccessKey":"${AccessKey.SecretAccessKey}"}'