Encrypted Access Key and Secret Key in # S3 IO Exit parameters

Thank you for taking the time to provide your ideas to IBM. After discussing with development, we believe the requested request for enhancement does not align with our product roadmap considering the boarder market needs. For that reason I am putting this as "Not under consideration" and we can revisit this once we see interest from more customers (via Voting or Comments)

I understand that this is not the answer you were expecting however if you have any additional feedback, thoughts or ideas, or if there is anything else I can do, please do not hesitate to reply to this message to continue the conversation. Appreciate your patience.

Regards,

Product Management

Access key and secret key are in clear text in this file, but it is possible to “hide” these keys using the credential_process property in the credentials file.The credentials file is documented by AWS. Configuration and credential file settings - AWS Command Line Interface (amazon.com)

Here is an example:

[profile appteam]

credential_process = /aPathTo/aScript.sh

The called script will return the keys in a JSON format on the stdout. The aws sdk will use it to get the keys. Here is an example:

{

"Version": 1,

"AccessKeyId": "value",

"SecretAccessKey": "value"

}

Here is an example of what could be achieved :

• Prepare an unencrypted JSON file with keys in clear.

• Encrypt this file with OpenSSL: openssl enc -aes-256-cbc -salt -in /aPath/ClearJSONRecord.txt -out /anotherPath/EncryptedJSONRecord.enc -k PASS

• Save the unencrypted file outside CD users and groups access

• Write a script to decrypt the file : openssl enc -aes-256-cbc -d -in /anotherPath/EncryptedJSONRecord.enc -k PASS

• Declare this script with the credential_process property in the credentials file.

It is also possible retrieve temporary and expiring credentials using AWS STS (AWS STS examples using AWS CLI - AWS Command Line Interface (amazon.com))

A more sophisticated solution:

• Call AWS STS to retrieve temporary credentials (returned in a JSON format) on a regular basis (using a cron job, before STS token expires), encrypt them to a file, touch the credentials file

• The script declared in credential_process decrypts when called. (CD requests the AWS SDK to monitor the credentials file change and the credentials mechanism will call the script again if file changed)

Thank you for taking the time to share your ideas to IBM. We truly value our relationship with you and appreciate your efforts and willingness to share details about your experience, your recommendations, and ideas. We will soon review the same in the coming weeks and shall get back with a response.

Thanks,

Product Management