awslabs / awslabs/agentcore-samples

Amazon Bedrock AgentCore Samples - Stop asking customers to make IAM users

Open
#271 1 comment 0 reactions 0 assignees View on GitHub
agentcore-samples enhancement
Dominant language
Python
Stars
3.4k
Forks
1.3k
Avg merge
1d 22h
Merged PRs (30d)
30

Description

It's a very not good thing to ask our customers to make IAM users, even for examples.

There are very serious security pitfalls, and most of the time when we help a customer respond to a security incident in their account it's because an IAM user access key pair has fallen under the control of a bad actor.

So in our material, we should not:

1)Ask customers to make IAM users
2)Imply the usage or creation of IAM users by telling them to setup access key pairs
3)Do not advise customers use legacy ways of configuring credentials, such as language specific .env files

and we should:

Direct the customer to run this samples in an environment that has AWS temp creds setup, like cloudshell or EC2
OR Use IAM identity center, and configure a default profile that can be used from their workstation so that the default credentials provider chain handles credential discovery.

Contributor guide

Open the contributing guide

Research direction

Review the Amazon Bedrock AgentCore samples for instructions that ask customers to create IAM users, access key pairs, or language-specific .env files. Start by locating those credential setup instructions; done means the samples direct customers to temporary credentials in CloudShell or EC2, or IAM Identity Center with the default credentials provider chain.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
authentication, documentation, security
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.