Hacker News Reader

Comment by pritambarhate | Hacker News Reader

I think it will be great if AWS allowed us to use the AWS keys to be used from certain IPs only. It will add additional layer of security which can help to prevent a lot of misuse. Just like AWS best practices of putting DB instances in a private VPC can prevent a lot of attack vectors, ability to use AWS Keys only from certain IPs or IP ranges, can also prevent from misuse, even if one accidentally leaks certain keys.

View on HN

Source IP is an IAM global condition so it's available for all requests.

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p...

Haven't tried it, but should be able to use service control policies to do this broadly.

https://docs.aws.amazon.com/organizations/latest/userguide/o...

Can definitely do it at the permission policy level as shown in the links others provided.

I don't think AWS wants to imply in any way that you need to be on a VPN to interact with AWS resources. It's not the direction they are going (Zero trust / RBA https://aws.amazon.com/security/zero-trust/).

Zero trust doesn’t mean no VPNs, it means not just VPNs. In other words you can put your control plane behind ACLs (and you should!) but you should still require strong auth from the private network.

This looks to be possible via this guide https://repost.aws/knowledge-center/iam-restrict-calls-ip-ad...

This example is for a role but for IAM users it works the same way.

It's already possible, but on a iam action level.

Reply on news.ycombinator.com