Since Adobe runs our AEM environment in AWS, we would like Adobe to make use of the AWS security features for my company

[#1]

Since Adobe runs our AEM environment in AWS, we would like Adobe to make use of the AWS security features for my company.  Here’s the specifics:

1. We want to use AWS STS to manage access to the companies Cognito service in AWS to get access to a JWT.  This is instead of using CryptoSupport.
2. We would like to make use of AWS Secrets Manager and/or AWS Parameter Store to protect sensitive data.  We would like to use a Customer Managed Key provided by the customer for Secrets Manager and Parameter Store.

Our objective is to not allow developer or Adobe support personnel from seeing any sensitive items like a password, api key, access credentials.  Since AWS has services that meet our needs, we would like Adobe to expose those services to us through the AEM authoring / administrative tools.

[#2]

HI,

I think this are topics you need to discuss with your CSE, because that's not standard. Regarding authentication I would recommend you to switch to use IMS ("AdminConsole") and connect it to your SAML provider. That should address a lot of the needs.

https://docs.adobe.com/content/help/en/experience-manager-64/administering/security/ims-config-and-a...

[#3]

As for SAML, the need is not for interactive logins.  The need to use STS is for API access back into our environment.   How do you protect secrets used to access APIs from their AEM applications?  If you use cryptosupport how do you determine if a developer or Adobe support person has accessed or compromised that secret?

[#4]

Hi @Eric_261 

I suggest to discuss your points with AMS team by contacting your TAM and/or CSE. The extent of this request is beyond AEM and needs a broader understanding and feasibility check. Your participation to this community is appreciated. 

[#5]

Updating the status accordingly since this is a very specific use case per my prior note.