13

I have a configuration file that contains AWS resource ARNs stored in a git repo. This includes some ARNs of AWS IAM role resources. Should these be treated as if they are a secret value, and not stored in a repository?

1 Answer 1

15

Well, from a security point of view, it's never bad to give people less information.

But, as long as you have sensible security policies in AWS, there is no reason that an arn has to be considered secret.

For example, if you know the arn of the role I use to access s3 from my EC2 instances, you can't do anything with that information unless I give you permission to assume that role from one of your roles. Between accounts, this is a very explicit and bidirectional action; so it will not happen by accident/without you knowing.

Losing the credentials to an IAM user could let people assume roles and would be terrible, but them knowing the arn alone does nothing for them.

2
  • 3
    I somewhat agree with giving people less information is never bad. While I agree less information won't result in something being less secure, I also strongly believe that "security by obscurity" is not a viable tactic. Hindering development processes to obscure data rather than digging into the source of your security issue (in this case having insecure IAM roles) is not a good practice. You always have to assume that if someone really wants your information, obscuring it won't work in the long run. I do agree though that locking down and giving specific access is much more important.
    – Preston Martin
    Mar 23, 2020 at 18:33
  • 2
    Wholeheartedly agree :). Mar 23, 2020 at 21:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.