https://pulumi.com
Join Slack
This message was deleted.
# aws
s
This message was deleted.
b
@icy-controller-6092 are you talking about the iam user with perms to use pulumi?
i
b
you likely don’t want an IAM user really, it’s not the ideal way. I wrote a blog post here on the how to auth to AWS the right way: https://leebriggs.co.uk/blog/2022/09/05/authenticating-to-aws-the-right-way the tl;dr is, for CI/CD - use OIDC for human users, use SSO If you don’t want to do that, you can define an IAM user and create credentials for it like this: https://github.com/jaxxstorm/pulumi-examples/blob/542cb445791885e0f53cf834fcd95b613d900139/typescript/aws/assume_role/index.ts#L5
i
ah thanks, AWS did try to tell me about SSO when I created the access key for the limited-scope IAM user, but it does look rather complicated (certainly way more complicated than using a access key for a very restricted account)
I'll give your article a try, I understand the sso login command would open a new browser window on first go, but after that all session refreshes are done behind the scenes? which I would need because I automate the deployment and wouldn't want a browser window to popup whenever I try to deploy
b
you wouldn’t use SSO for CI/CD or automated deployments, just human users
so you wouldn’t need the browser window
i
I'm running my deployments locally for now, as I am solo dev. trying to grok the difference between these two approaches: • https://docs.aws.amazon.com/cli/latest/userguide/sso-configure-profile-token.html • https://github.com/jaxxstorm/aws-sso-creds I think they would both solve the issue of the browser window being opened beyond the first login
b
I understand the sso login command would open a new browser window on first go, but after that all session refreshes are done behind the scenes?
You get a session token that expires after a configurable time, you don’t need to do any refresh until the next day. The workflow generally is to login at the start of the day and not worry about it after that
aws-sso-creds is just a tool to automate retrieving credentials from an SSO session
i
I definitely agree with your article opener - they make the right decision hard.
I'm just going to keep using the access key for my IAM user, I've given it very little permissions so the effort to learn SSO etc doesn't seem worth it
7 Views
Open in Slack
PreviousNext
Powered by

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Powered by