.NET8控制台应用生产环境AWS S3/CloudFront权限配置咨询

Q1: Should we create a virtual user in IAM Identity Center? #

No. IAM Identity Center is built for human users (employees, contractors) needing interactive AWS access. For service applications like your .NET console app, use IAM Roles (if running on AWS infrastructure) or dedicated IAM Users (if running outside AWS) instead.

Q2: Do we need AWS Access Key/Secret Key? If yes, dedicated service user? #

• If your app runs outside AWS (e.g., on-prem servers, local machines): Yes. Create a dedicated IAM User (never use your admin account) with minimal permissions, then generate access keys for this user.
• If your app runs on AWS (e.g., EC2, ECS, Lambda): Avoid access keys entirely. Use IAM Roles attached to the resource—AWS automatically provides temporary, rotating credentials to the app without needing to store keys.

Q3: How to handle long-term authentication? #

• AWS-hosted apps: Use IAM Roles. You can configure the role’s maximum session duration up to 24 hours (default is 1 hour). The app will automatically fetch temporary credentials that refresh within this window.
• External apps: Use an IAM User with access keys. Store keys securely (e.g., environment variables, AWS Secrets Manager) and rotate them regularly (every 90 days is a best practice). Since access keys are long-term, security relies on strict permission policies and regular key rotation.

High-Level Steps to Configure Restricted Permissions #

1. Create a Least-Privilege IAM Policy
   Define only the actions your app needs for the specific S3 bucket and CloudFront distribution:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": ["s3:PutObject", "s3:GetObject"],
         "Resource": "arn:aws:s3:::your-bucket-name/*"
       },
       {
         "Effect": "Allow",
         "Action": "cloudfront:CreateInvalidation",
         "Resource": "arn:aws:cloudfront::123456789012:distribution/your-distribution-id"
       }
     ]
   }
   

2. Attach Policy to IAM Role or User

   • For AWS-hosted apps: Create an IAM Role, attach the policy, assign the role to your EC2 instance/ECS task, and adjust the role’s maximum session duration to 24 hours in role settings.
   • For external apps: Create an IAM User, attach the policy, generate access keys for the user, and store them securely in your app’s configuration (never hardcode).

3. Configure App Authentication

   • For .NET apps using AWS SDK:
     • IAM Roles: The SDK automatically retrieves credentials from the AWS environment (EC2 metadata, ECS task role, etc.).
     • Access Keys: Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as environment variables (preferred for production) or use the AWS credentials file.

内容的提问来源于stack exchange，提问作者Chris Walsh