0

I have a private S3 bucket. I want a user from an external organisation to have access.

I have added a user in IAM. How does this external user get notified and how do I share credentials?

The secret key, at a minimum, should not be shared over email, etc.

Improve this question

1 Answer 1

Reset to default
0

This depends on your risk appetite. There are several options including using something like GPG to encrypt the file with a public key the user provides to you. You could also password protect the encrypted file and give the user the password to decrypt the file over the phone. A slightly less secure alternative would be to set up a pre-signed URL in S3 and have them download it, then you immediately delete the file in S3 after they do. There are several tried and true methods for delivering secrets, you just need to find one that fits your risk acceptance.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .