Backups to S3, keylessly issue #178
closed: completed andymccall opened this · 0 comments
andymccall
docs/backups.md §3, §6.1. An S3 destination: the hub's own token (sub backup:OWNER, aud sts.amazonaws.com) exchanged at AWS STS (AssumeRoleWithWebIdentity) for an hour's credentials of the owner's IAM role; requests signed with SigV4 (unit-tested against AWS's published GET Object example). Setting: bucket, region (migration 0063), role ARN. Tested end to end against a fake STS and S3 that verify every signature. Setup commands for Andy in §6.1; no cloud resources created.
docs/backups.md §3, §6.1. An S3 destination: the hub's own token (sub backup:OWNER, aud sts.amazonaws.com) exchanged at AWS STS (AssumeRoleWithWebIdentity) for an hour's credentials of the owner's IAM role; requests signed with SigV4 (unit-tested against AWS's published GET Object example). Setting: bucket, region (migration 0063), role ARN. Tested end to end against a fake STS and S3 that verify every signature. Setup commands for Andy in §6.1; no cloud resources created.