How is AWS app identity verified?

Question

So I get the notion of roles and service-linked roles and policies in AWS. However, all of that works only if the principal/identity (and I know there's a difference between the two, but using either term quite liberally here) being claimed by an app can be verified (i.e. app authentication). I am guessing this authentication occurs against the "AWS fabric" and not the target service/resource the app wants to access.

Can anyone share details of how an app establishes its identity and how the "fabric" verifies the identity?

Azure has the notion of managed service identities (based on system assigned identity and VM extensions).

• What's the equivalent on AWS? How does the AWS "fabric" assign/verify app identities?
• If the only mechanism for verification is an access key and secret key (or a bearer token), I would think that's either a circular problem for credential management or very insecure.

Of course, I could be totally wrong in the way I am comparing Azure identity management to AWS, but it seems that a credential-less verification/assignment of identity as in Azure is probably as secure as it gets.

Answer 1

I've never used Azure, but that looks similar to AWS KMS that apparently also uses HashiCorp Vault. You can see some use cases here.

Take a look at this, I think it explain what you need.

EC2 auth method Amazon EC2 instances have access to metadata which describes the instance. The Vault EC2 auth method leverages the components of this metadata to authenticate and distribute an initial Vault token to an EC2 instance. The data flow (which is also represented in the graphic below) is as follows:

Vault AWS EC2 Authentication Flow

An AWS EC2 instance fetches its AWS Instance Identity Document from the EC2 Metadata Service. In addition to data itself, AWS also provides the PKCS#7 signature of the data, and publishes the public keys (by region) which can be used to verify the signature.

The AWS EC2 instance makes a request to Vault with the PKCS#7 signature. The PKCS#7 signature contains the Instance Identity Document within itself.

Vault verifies the signature on the PKCS#7 document, ensuring the information is certified accurate by AWS. This process validates both the validity and integrity of the document data. As an added security measure, Vault verifies that the instance is currently running using the public EC2 API endpoint.

Provided all steps are successful, Vault returns the initial Vault token to the EC2 instance. This token is mapped to any configured policies based on the instance metadata.

There are various modifications to this workflow that provide more or less security, as detailed later in this documentation.