Deprecating long-lived credentials for modules
To improve the security of services running on the Cloud Platform, we are removing the ability to create and use long-lived credentials, such as IAM access keys, from our modules. These are being replaced by short-lived credentials.
Long-lived credentials are typically used for checking resource configuration, running aws CLI commands or getting access to namespace resources like SQS or SNS. The removal of long-lived credentials does not impact how you connect to your relational database or Redis cluster.
For modules, except container repositories, this means utilising IAM roles for service accounts (IRSA).
You should start using short-lived credentials as soon as you can. Long-lived credentials were removed from modules on the following dates:
| Module | Access keys are used for | Removal date | Users as at 8th June 2023 |
|---|---|---|---|
| cloud-platform-terraform-dms | Starting replication tasks | 4th September 2023 | 1 |
| cloud-platform-terraform-dynamodb-cluster | Accessing the database | 4th September 2023 | 19 |
| cloud-platform-terraform-elasticache-cluster | Rotating AUTH tokens | 4th September 2023 | 218 |
| cloud-platform-terraform-rds-aurora | Taking manual backups | Removed | - |
| cloud-platform-terraform-rds-instance | Taking manual backups | 4th September 2023 | 400 |
| cloud-platform-terraform-s3-bucket | Accessing the bucket | 4th September 2023 | 197 |
| cloud-platform-terraform-sns-topic | Accessing the topic | 4th September 2023 | 24 |
| cloud-platform-terraform-sqs | Accessing the queue | 4th September 2023 | 565 |
Migrating to short-lived credentials
The modules listed above all output an attribute named irsa_policy_arn, which has the same permissions as the long-lived credentials.
You should follow the Accessing AWS APIs and resources from your namespace guide to migrate to short-lived credentials, and use the respective module’s output of irsa_policy_arn when configuring the IRSA module.
Once you’ve set up IRSA in your namespace you will need to:
Remove references to long-lived credentials (i.e. IAM access keys) from your application
This is to ensure that the AWS SDK does not fall back to using long-lived credentials when the AWS SDK is initialised.
Redeploy and test your service to ensure your service still works correctly
The most recent versions of AWS SDKs automatically configure credentials in a way that works with IRSA.
If you use a custom credential provider with the AWS SDK, you should refer to the AWS SDK guides to implement
AssumeRoleWithWebIdentityas a credential provider.