Since Adobe runs our AEM environment in AWS, we would like Adobe to make use of the AWS security features for my company

Eric_261

01-10-2020

Since Adobe runs our AEM environment in AWS, we would like Adobe to make use of the AWS security features for my company.  Here’s the specifics:

  1. We want to use AWS STS to manage access to the companies Cognito service in AWS to get access to a JWT.  This is instead of using CryptoSupport.
  2. We would like to make use of AWS Secrets Manager and/or AWS Parameter Store to protect sensitive data.  We would like to use a Customer Managed Key provided by the customer for Secrets Manager and Parameter Store.

Our objective is to not allow developer or Adobe support personnel from seeing any sensitive items like a password, api key, access credentials.  Since AWS has services that meet our needs, we would like Adobe to expose those services to us through the AEM authoring / administrative tools.

3 Comments (3 New)
3 Comments

Jörg_Hoh

Employee

01-10-2020

HI,

I think this are topics you need to discuss with your CSE, because that's not standard. Regarding authentication I would recommend you to switch to use IMS ("AdminConsole") and connect it to your SAML provider. That should address a lot of the needs.

 

https://docs.adobe.com/content/help/en/experience-manager-64/administering/security/ims-config-and-a...

Eric_261

02-10-2020

As for SAML, the need is not for interactive logins.  The need to use STS is for API access back into our environment.   How do you protect secrets used to access APIs from their AEM applications?  If you use cryptosupport how do you determine if a developer or Adobe support person has accessed or compromised that secret?

hamidk92094312

Employee

02-10-2020

Hi @Eric_261 

I suggest to discuss your points with AMS team by contacting your TAM and/or CSE. The extent of this request is beyond AEM and needs a broader understanding and feasibility check. Your participation to this community is appreciated.