How has to be the kmsauth token created? about bless HOT 1 CLOSED

Hello @marranz,

I'm not sure if you have already solved this yourself, but I recently played with BLESS and kmsauth.

1. The user_type has to be set to user. A type service is for two services to communicate with each other, and is used in Lyft's other projects that utilise kmsauth (like https://github.com/lyft/confidant).

2. The from must be your AWS IAM username, which should be enforced by the IAM policy that grants kms:Encrypt to your user. (https://github.com/lyft/python-blessclient#setup-a-kmsauth-key--policy-in-your-aws-account)

3. kmsauth_remote_usernames_allowed should only contain shared accounts. Anyone who has permission to invoke the BLESS lambda can also add these usernames to their certificate.

I found this guide useful when getting started. http://www.tastycidr.net/a-practical-guide-to-deploying-netflixs-bless-certificate-authority/

from bless.