Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

We test it against real AWS deployments. With a proper multi-account strategy + SSO, there are no AWS credentials to leak + blast radius is limited.

The feedback loop is definitely a problem but projects like SST return the instant feedback loop to you.



The credentials are the API keys and secrets, not the login and passwords.

One improper setting in IAM and an accidental pastebin or GitHub means half the automated hacks have access to the same thing the IAM user does.

I did this once on accident by hitting control-V instead of control-c and overwriting my censored version before pasting into GitHub so other people could save the 4 hours of tedious scripting I had to do. GitHub sends an email within minutes, but I was already miles away from a computer when I got the email...


And I think this can be a good idea, but only sometimes. Mostly I think you should just use LocalStack.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: