> Establishing AWS identity outside of AWS is a headache, and often comes with a chicken-and-egg problem of needing to possess a secret to show you are allowed to get a secret.

> For most stuff here, we can rely on the fact that every connection over Tailscale is encrypted and authenticated to an identity

Mm, okay, but you still have the chicken and egg problem of distributing the creds to join your tailnet.

Isn’t it not that different than distributing aws creds to access secrets manager?