Since Adobe runs our AEM environment in AWS, we would like Adobe to make use of the AWS security features for my company

Avatar

Avatar

Eric_261

Avatar

Eric_261

Eric_261

01-10-2020

Since Adobe runs our AEM environment in AWS, we would like Adobe to make use of the AWS security features for my company.  Here’s the specifics:

  1. We want to use AWS STS to manage access to the companies Cognito service in AWS to get access to a JWT.  This is instead of using CryptoSupport.
  2. We would like to make use of AWS Secrets Manager and/or AWS Parameter Store to protect sensitive data.  We would like to use a Customer Managed Key provided by the customer for Secrets Manager and Parameter Store.

Our objective is to not allow developer or Adobe support personnel from seeing any sensitive items like a password, api key, access credentials.  Since AWS has services that meet our needs, we would like Adobe to expose those services to us through the AEM authoring / administrative tools.

4 Comments

Avatar

Avatar

Jörg_Hoh

Employee

Total Posts

3.0K

Likes

991

Correct Reply

1.0K

Avatar

Jörg_Hoh

Employee

Total Posts

3.0K

Likes

991

Correct Reply

1.0K
Jörg_Hoh
Employee

01-10-2020

HI,

I think this are topics you need to discuss with your CSE, because that's not standard. Regarding authentication I would recommend you to switch to use IMS ("AdminConsole") and connect it to your SAML provider. That should address a lot of the needs.

 

https://docs.adobe.com/content/help/en/experience-manager-64/administering/security/ims-config-and-a...

Avatar

Avatar

Eric_261

Avatar

Eric_261

Eric_261

02-10-2020

As for SAML, the need is not for interactive logins.  The need to use STS is for API access back into our environment.   How do you protect secrets used to access APIs from their AEM applications?  If you use cryptosupport how do you determine if a developer or Adobe support person has accessed or compromised that secret?

Avatar

Avatar

hamidk92094312

Employee

Avatar

hamidk92094312

Employee

hamidk92094312
Employee

02-10-2020

Hi @Eric_261 

I suggest to discuss your points with AMS team by contacting your TAM and/or CSE. The extent of this request is beyond AEM and needs a broader understanding and feasibility check. Your participation to this community is appreciated. 

Avatar

Avatar

hamidk92094312

Employee

Avatar

hamidk92094312

Employee

hamidk92094312
Employee

16-12-2020

Updating the status accordingly since this is a very specific use case per my prior note.

Status changed to: Declined