Answers: <p>Well, from a security point of view, it's never bad to give people less information.</p>
  
  <p>But, as long as you have sensible security policies in AWS, there is no reason that an arn has to be considered secret.</p>
  
  <p>For example, if you know the arn of the role I use to access s3 from my EC2 instances, you can't do anything with that information unless I give you permission to assume that role from one of your roles.  Between accounts, this is a very explicit and bidirectional action; so it will not happen by accident/without you knowing.</p>
  
  <p>Losing the credentials to an IAM user could let people assume roles and would be terrible, but them knowing the arn alone does nothing for them.</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-03-23T18:33:44.240Z
Answers: I somewhat agree with giving people less information is never bad. While I agree less information won't result in something being less secure, I also strongly believe that "security by obscurity" is not a viable tactic. Hindering development processes to obscure data rather than digging into the source of your security issue (in this case having insecure IAM roles) is not a good practice. You always have to assume that if someone really wants your information, obscuring it won't work in the long run. I do agree though that locking down and giving specific access is much more important.
Answers: Preston Martin
Answers: CC BY-SA 4.0
Answers: 2020-03-23T21:40:05.367Z
Answers: Wholeheartedly agree :).
Answers: John Humphreys
Answers: CC BY-SA 4.0
Answers: 2020-03-18T17:08:20.027Z
Answers: 2020-03-18T17:14:10.583Z
Answers: 2020-03-18T17:14:10.583Z
Answers: John Humphreys
Body: <p>I have a configuration file that contains AWS resource ARNs stored in a git repo. This includes some ARNs of AWS IAM role resources. Should these be treated as if they are a secret value, and not stored in a repository?</p>
  
Tags: <amazon-web-services><aws-iam><secret-management>
Title: Should AWS arn values be treated as secrets?
UserDisplayName: Preston Martin
ThreadText: # Should AWS arn values be treated as secrets?
  
  (Asked by: username_0 on 2020-03-18)
  
  I have a configuration file that contains AWS resource ARNs stored in a git repo. This includes some ARNs of AWS IAM role resources. Should these be treated as if they are a secret value, and not stored in a repository?
  
  **Tags:** amazon-web-services, aws-iam, secret-management
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2020-03-18. Score: 15 | Accepted answer
  
  Well, from a security point of view, it's never bad to give people less information.
  
  But, as long as you have sensible security policies in AWS, there is no reason that an arn has to be considered secret.
  
  For example, if you know the arn of the role I use to access s3 from my EC2 instances, you can't do anything with that information unless I give you permission to assume that role from one of your roles. Between accounts, this is a very explicit and bidirectional action; so it will not happen by accident/without you knowing.
  
  Losing the credentials to an IAM user could let people assume roles and would be terrible, but them knowing the arn alone does nothing for them.
  
  > **Comments:**
  > **username_0**: I somewhat agree with giving people less information is never bad. While I agree less information won't result in something being less secure, I also strongly believe that "security by obscurity" is not a viable tactic. Hindering development processes to obscure data rather than digging into the source of your security issue (in this case having insecure IAM roles) is not a good practice. You always have to assume that if someone really wants your information, obscuring it won't work in the long run. I do agree though that locking down and giving specific access is much more important.  
  > **username_1**: Wholeheartedly agree :).  
  
  ---
  
  