MMS • Steef-Jan Wiggers
Article originally posted on InfoQ. Visit InfoQ
AWS recently announced the general availability (GA) of private access to the AWS management console. Private access is a new security feature that allows customers to limit access to the AWS Management Console from their Virtual Private Cloud (VPC) or connected networks to a set of trusted AWS accounts and organizations.
Under the hood, private access to the management consoles is possible using VPC Endpoints and AWS PrivateLink, which provides customers control over which networks can access their accounts and AWS Organizations and denies attempts from others.
Customers can use VPC endpoint policies for AWS Management Console Private Access to limit the set of accounts that are allowed to use the AWS Management Console from within their VPC and its connected on-premises networks.
A respondent on a Reddit thread on the Private Access feature for the AWS Management Console asked:
Is this AWS throwing up their hands to everybody who thinks IP addresses are a reasonable security measure?
With another one answering:
As a DevOps person, I would argue that having an IP allowlist is better than not having one. I don’t think it’s a matter of which is better or worse. I think, ‘porque no los dos’ because there’s a lot of dangerous stuff the console is there to protect. I’m purely responding to the notion that IP allowlists are not as good as authentication, which to me, feels like saying the luggage scanner at the airport is better/worse than the full-body scanner.
In addition, Etienne Beurex tweeted:
Very nice feature that will be very helpful for compliance audits, just wish AWS wouldn’t call “GA” features that are available in only a handful of regions.
Sébastien Stormacq, a principal developer advocate at AWS, responded:
I understand the frustration. We prefer to release early and release often to gather feedback and iterate quickly based on customer requirements. Regional expansion is a priority with the long-term goal to have feature parity between regions.
Currently, Private Access is available in the following AWS Regions: US East (Ohio), US East (N. Virginia), US West (Oregon), Europe (Ireland), and Asia Pacific (Singapore).