awslabs / awslabs/agentcore-samples
Amazon Bedrock AgentCore Samples - Stop asking customers to make IAM users
- Dominant language
- Python
- Stars
- 3.4k
- Forks
- 1.3k
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 30
Description
It's a very not good thing to ask our customers to make IAM users, even for examples.
There are very serious security pitfalls, and most of the time when we help a customer respond to a security incident in their account it's because an IAM user access key pair has fallen under the control of a bad actor.
So in our material, we should not:
1)Ask customers to make IAM users
2)Imply the usage or creation of IAM users by telling them to setup access key pairs
3)Do not advise customers use legacy ways of configuring credentials, such as language specific .env files
and we should:
Direct the customer to run this samples in an environment that has AWS temp creds setup, like cloudshell or EC2
OR Use IAM identity center, and configure a default profile that can be used from their workstation so that the default credentials provider chain handles credential discovery.
Contributor guide
Research direction
Review the Amazon Bedrock AgentCore samples for instructions that ask customers to create IAM users, access key pairs, or language-specific .env files. Start by locating those credential setup instructions; done means the samples direct customers to temporary credentials in CloudShell or EC2, or IAM Identity Center with the default credentials provider chain.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- authentication, documentation, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100