Mechanical Turk is Insecure
and Amazon doesn’t seem to care.
Mechanical Turk is one of the last services offered by AWS which is lacking support for IAM, Amazon’s Identity and Access Management service. This means you have to login with your account’s master keys. This is terrifying.
Think about that for a second.
These are literally the keys for your entire AWS account; EC2 servers, load balancers, EBS volumes, S3, Route53 DNS, Databases, plus everything else on this giant list.
IAM, released in late 2010, allows AWS users to make keys for specific jobs — like uploading to your production S3 bucket, reading (not writing) messages to a queue or starting a new database server.
It’s awesome as it allows one to create keys based on principle of least privilege.
The recent Circle CI and Mongo HQ incidents prompted us to look again at our own infrastructure. Mechanical Turk’s lack of support for decent access management turned out to be the biggest flaw — and we can’t fix it.
At Rainforest we push a lot of jobs through Mechanical Turk, so I contacted our account manager asking them to find out;
We don’t currently support IAM, and while it could be something that we add in the future, I’m not able to give you any sort of confirmation or timeframe for when the feature would be available.
Additionally, while we don’t have specific best practices for securing master keys, here are some best practices that could be helpful related to key rotation, etc.
If you have more specific questions related to securing master keys, I’m happy to help address them for you.
Key rotation. Yes, it’s a good practice, but no it’s not helpful if your master keys are compromised.
To me this isn’t an acceptable answer, though I’m not sure how I can get an actual answer.
We really want to know if it is planned at all, and if not why a glaring security risk is not a priority to AWS. I’ve written this to make sure everyone using mturk or thinking about it is aware of this glaring vulnerability.
What do you think? Discuss on HN.
/cc @Werner
Email me when Russell Smith publishes or recommends stories