Since Adobe runs our AEM environment in AWS, we would like Adobe to make use of the AWS security features for my company | Community
Skip to main content
Eric_261
October 1, 2020
Declined

Since Adobe runs our AEM environment in AWS, we would like Adobe to make use of the AWS security features for my company

  • October 1, 2020
  • 4 replies
  • 2042 views

Since Adobe runs our AEM environment in AWS, we would like Adobe to make use of the AWS security features for my company.  Here’s the specifics:

  1. We want to use AWS STS to manage access to the companies Cognito service in AWS to get access to a JWT.  This is instead of using CryptoSupport.
  2. We would like to make use of AWS Secrets Manager and/or AWS Parameter Store to protect sensitive data.  We would like to use a Customer Managed Key provided by the customer for Secrets Manager and Parameter Store.

Our objective is to not allow developer or Adobe support personnel from seeing any sensitive items like a password, api key, access credentials.  Since AWS has services that meet our needs, we would like Adobe to expose those services to us through the AEM authoring / administrative tools.

4 replies

joerghoh
Adobe Employee
Adobe Employee
October 1, 2020

HI,

I think this are topics you need to discuss with your CSE, because that's not standard. Regarding authentication I would recommend you to switch to use IMS ("AdminConsole") and connect it to your SAML provider. That should address a lot of the needs.

 

https://docs.adobe.com/content/help/en/experience-manager-64/administering/security/ims-config-and-admin-console.html

Eric_261
Eric_261Author
October 2, 2020

As for SAML, the need is not for interactive logins.  The need to use STS is for API access back into our environment.   How do you protect secrets used to access APIs from their AEM applications?  If you use cryptosupport how do you determine if a developer or Adobe support person has accessed or compromised that secret?

Adobe Employee
October 3, 2020

Hi @eric_261 

I suggest to discuss your points with AMS team by contacting your TAM and/or CSE. The extent of this request is beyond AEM and needs a broader understanding and feasibility check. Your participation to this community is appreciated. 

Adobe Employee
December 17, 2020

Updating the status accordingly since this is a very specific use case per my prior note.