1 of 117

Managing AWS Access for Humans and AI Agents

Alexey Grigorev

2 of 117

Me

3 of 117

Exasol person

4 of 117

want to make a workshop?

5 of 117

yes

6 of 117

Me home

7 of 117

laptop

Me home

8 of 117

laptop

Exasol Personal

Me home

9 of 117

laptop

Exasol Personal

Me home

10 of 117

Workshop

11 of 117

Workshop

12 of 117

Workshop

Exasol Personal

13 of 117

Workshop

Exasol Personal

14 of 117

Workshop

Exasol Personal

15 of 117

Workshop

Exasol Personal

16 of 117

Workshop

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

17 of 117

Workshop

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

18 of 117

Workshop

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

Exasol Personal

???

19 of 117

laptop

Exasol Personal

Other people

20 of 117

laptop

Exasol Personal

???

Other people

21 of 117

laptop

Exasol Personal

???

Other people

my key??

22 of 117

my

IAM

Me

23 of 117

my

IAM

ec2

24 of 117

my

IAM

Exasol Personal

ec2

25 of 117

my

IAM

Exasol Personal

ec2

26 of 117

my

IAM

ec2

ec2

ec2

ec2

ec2

ec2

ec2

Exasol Personal

???

my key??

27 of 117

my

IAM

ec2

ec2

ec2

ec2

ec2

ec2

ec2

Exasol Personal

???

my key??

codespaces

28 of 117

Codespaces but with instance profiles

my

IAM

ec2

ec2

ec2

ec2

ec2

ec2

ec2

Exasol Personal

???

my key??

codespaces

29 of 117

Instance profile

ec2

Exasol Personal

30 of 117

Instance profile

  • Launch instance
  • ​

31 of 117

Instance profile

  • Launch instance
  • Access the service

32 of 117

Instance profile

  • Launch instance
  • Access the service
  • Works while instance is up

33 of 117

Instance profile

  • Launch instance
  • Access the service
  • Works while instance is up
  • No keys and stuff

34 of 117

Instance profile

​

How does it work???

35 of 117

Instance profile

  • Launch instance

​

36 of 117

Instance profile

  • Launch instance
  • EC2 sees the role

​

37 of 117

Instance profile

  • Launch instance
  • EC2 sees the role
  • Calls STS assume role

​

38 of 117

Instance profile

  • Launch instance
  • EC2 sees the role
  • Calls STS assume role
  • Get temp creds

​

39 of 117

Instance profile

  • Launch instance
  • EC2 sees the role
  • Calls STS assume role
  • Get temp creds
  • Creds cached

​

40 of 117

Instance profile

  • Launch instance
  • EC2 sees the role
  • Calls STS assume role
  • Get temp creds
  • Creds cached
  • Refresh when expiry

41 of 117

Instance profile

​

User has no clue

But has always on access

​

42 of 117

Instance profile

​

Can we do the same with Codespaces???

43 of 117

Yes!

44 of 117

Yes!

AWS_CONTAINER_CREDENTIALS_FULL_URI

​

45 of 117

Yes!

AWS_CONTAINER_CREDENTIALS_FULL_URI

​

46 of 117

Codespaces (AWS SDK)

47 of 117

Codespaces (AWS SDK)

AWS_CONTAINER_CREDENTIALS_FULL_URI

48 of 117

Codespaces (AWS SDK)

Lambda

AWS_CONTAINER_CREDENTIALS_FULL_URI

49 of 117

Codespaces (AWS SDK)

Lambda

AWS_CONTAINER_CREDENTIALS_FULL_URI

50 of 117

Codespaces (AWS SDK)

Lambda

AWS_CONTAINER_CREDENTIALS_FULL_URI

Creds

51 of 117

Codespaces (AWS SDK)

Lambda

STS

52 of 117

Codespaces (AWS SDK)

Lambda

STS

GET token

53 of 117

Codespaces (AWS SDK)

Lambda

STS

GET token

Assume role

54 of 117

Codespaces (AWS SDK)

Lambda

STS

GET token

Assume role

Temporary credentials

55 of 117

Codespaces (AWS SDK)

Lambda

STS

GET token

Assume role

Temporary credentials

Temporary credentials

56 of 117

Codespaces (AWS SDK)

Lambda

STS

GET token

Assume role

Temporary credentials

Temporary credentials

15 minutes later

57 of 117

Codespaces (AWS SDK)

Lambda

STS

GET token

Assume role

Temporary credentials

Temporary credentials

15 minutes later

Auto-refresh GET token

58 of 117

Just like instance profiles!

59 of 117

Other people

60 of 117

Codespaces

61 of 117

Codespaces

Lambda

62 of 117

Codespaces

Exasol Personal

Lambda

63 of 117

Codespaces

Exasol Personal

Lambda

64 of 117

  • Sandbox account

​

The setup

65 of 117

  • Sandbox account
  • Lambda

​

The setup

66 of 117

  • Sandbox account
  • Lambda
  • Repository template (.devcontainer)

The setup

67 of 117

  • Fork the repo

​

On the workshop

68 of 117

  • Fork the repo
  • Share the secret offline

​

On the workshop

69 of 117

  • Fork the repo
  • Share the secret offline
  • Create a codespace

​

On the workshop

70 of 117

  • Fork the repo
  • Share the secret offline
  • Create a codespace
  • Workshop

On the workshop

71 of 117

  • Rotate the secret

​

When the workshop ends

72 of 117

  • Rotate the secret
  • Or delete the sandbox account

When the workshop ends

73 of 117

https://github.com/alexeygrigorev/aws-workshop-credentials

74 of 117

A few months later

75 of 117

Me

76 of 117

Claude

77 of 117

Claude

Codex

78 of 117

Claude

Codex

AWS

79 of 117

Claude

Codex

AWS

admin access

80 of 117

81 of 117

82 of 117

ALEXEYONDATA.SUBSTACK.COM

83 of 117

Claude

Codex

AWS

admin access

84 of 117

Claude

Codex

AWS

admin access

laptop

85 of 117

Claude

Codex

AWS

admin access

laptop

remote sandbox

Claude

Codex

86 of 117

AWS

admin access

laptop

remote sandbox

Claude

Codex

87 of 117

AWS

admin access

laptop

remote sandbox

Claude

Codex

ssh

88 of 117

AWS

admin access

laptop

remote sandbox

Claude

Codex

ssh

89 of 117

AWS

admin access

laptop

remote sandbox

Claude

Codex

ssh

I need to deploy something

90 of 117

AWS

admin access

laptop

remote sandbox

Claude

Codex

ssh

I need agents to experiment

91 of 117

AWS

admin access

laptop

remote sandbox

Claude

Codex

ssh

I need agents to experiment

Sandbox account

92 of 117

AWS

admin access

laptop

remote sandbox

Claude

Codex

ssh

I need agents to experiment

Sandbox account

temp cred

.env

93 of 117

AWS

admin access

laptop

remote sandbox

Claude

Codex

ssh

I need agents to experiment

Sandbox account

temp cred

.env

94 of 117

AWS

admin access

laptop

remote sandbox

Claude

Codex

ssh

I need agents to experiment

Sandbox account

temp cred

.env

95 of 117

I need agents to experiment with infra

uv run aws-sandbox-cli creds \

--remote-host hetzner \

--remote-path '~/tmp/lambda-deploy/.env'

96 of 117

I need agents to experiment with infra

https://github.com/alexeygrigorev/aws-sandbox-cli

uv run aws-sandbox-cli creds \

--remote-host hetzner \

--remote-path '~/tmp/lambda-deploy/.env'

97 of 117

What if I’m not on my laptop?

AWS

admin access

laptop

remote sandbox

Claude

Codex

ssh

Sandbox account

temp cred

.env

uv run aws-sandbox-cli creds \

--remote-host hetzner \

--remote-path '~/tmp/lambda-deploy/.env'

98 of 117

remote sandbox

Claude

Codex

ssh

99 of 117

remote sandbox

Claude

Codex

ssh

100 of 117

remote sandbox

Claude

Codex

ssh

I need agents to experiment

101 of 117

I need agents to experiment

  • I’m on my phone

102 of 117

I need agents to experiment

  • I’m on my phone
  • No creds on phone

103 of 117

I need agents to experiment

  • I’m on my phone
  • No creds on phone
  • No ssh to laptop

104 of 117

I need agents to experiment

  • I’m on my phone
  • No creds on phone
  • No ssh to laptop
  • Temporary sandbox access

​

105 of 117

I need agents to experiment

  • I’m on my phone
  • No creds on phone
  • No ssh to laptop
  • Temporary sandbox access
  • Revoke when not needed

106 of 117

I need agents to experiment

107 of 117

  • Turn on -> experiment

​

I need agents to experiment

108 of 117

  • Turn on -> experiment
  • Turn off -> no access

I need agents to experiment

109 of 117

remote sandbox

AWS SDK

Lambda

AWS_CONTAINER_CREDENTIALS_FULL_URI

Creds

110 of 117

remote sandbox

AWS SDK

Lambda

AWS_CONTAINER_CREDENTIALS_FULL_URI

unauthorized

111 of 117

I need agents to experiment

112 of 117

I need agents to experiment

59:13 left

113 of 117

I’m done

114 of 117

115 of 117

https://github.com/alexeygrigorev/phone-aws-gate

116 of 117

Demo

117 of 117

Find me online

ALEXEYONDATA.SUBSTACK.COM

I’m done