Simon Willison

Support one or more `--key` options to create credentials restricted to a specific key

2

The new `--prefix` option from #12 lets you set a wildcard prefix for key access - but it strikes me that it would also be useful to be able to...

create fails if user already has two access keys

2

> Incidentally, trying to call create with the same username 3 times hits the issue you've noted above, that there can only be 2 active access keys: > > ```bash...

There is enough useful logic in here that it would be good to have it work as a stable, documented Python library (similar to `sqlite-utils`). The logic in the `create`...

Research potential for an access points feature

3

Suggestion [from Reddit](https://www.reddit.com/r/aws/comments/s6p9ic/s3credentials_prefix_tool_for_creating_s3/). https://aws.amazon.com/s3/features/access-points/ Could provide CLI commands for creating an access point that enforces a specific policy. From https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points.html : > Access points are named network endpoints that are...

Currently the `s3-credentals create --prefix x` option (from #12) can only be used once. It would be useful if you could provide it more than once to allow access to...

Clean up resources created in #51

1

In #51 I created `litestream-test-20220117` bucket and `s3.read-write.litestream-test-20220117` user. Need to delete those again.

> `list-user-policies` doesn't output JSON at all, it has a weird custom output - so I'm leaving it for the moment. _Originally posted by @simonw in https://github.com/simonw/s3-credentials/issues/48#issuecomment-1014996451_

https://www.reddit.com/r/aws/comments/qlu3ag/comment/hj68pmv/ pointed out `simulate_custom_policy()` which is an API method that lets you try out custom policies. https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/iam.html#IAM.Client.simulate_custom_policy Must be some useful stuff I can do with this. A CLI command...

https://aws.amazon.com/about-aws/whats-new/2021/11/amazon-s3-object-ownership-simplify-access-management-data-s3/

Use PublicAccessBlockConfiguration for extra defense in depth against accidental public access

4

> Require a flag to enable public access to the bucket rather than making the bucket public by default. See [docs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/configuring-block-public-access-bucket.html) _Originally posted by @zacaytion in https://github.com/simonw/s3-credentials/issues/7#issuecomment-960003036_