shonindocs

Reference

Security

The tokens AWS accepts are signed in your AWS account, by your installation, after it checks the second factor itself. Shonin alone cannot open your accounts.

#How a sign-in works

  1. You sign in to Shonin, with a password or with your identity provider, and enter your second factor.
  2. Shonin signs a token that says who you are, with a key in AWS KMS, and sends your request to your installation through a queue.
  3. Your installation checks that token, your second factor and your assignments.
  4. It signs a short token with its own KMS key, in your account, and calls AssumeRoleWithWebIdentity on the role of your permission set.
  5. It returns a console sign-in link or temporary credentials.

With more AWS organizations, the installation of the account's AWS organization signs, and accepts the second factor only as checked by the installation that keeps the authenticator apps, which signs that check for your session.

The roles of your permission sets trust only the issuer of your installation. Their trust policy requires the audience of Shonin, a subject that names that Shonin org, permission set and account, and the email of the person as the name of the session.

#What runs in your AWS account

The installation, in your management account: a container with no inbound network access, a KMS signing key that only it can use, a private state bucket encrypted with a KMS key of the installation, and the roles of your permission sets in the accounts where you assign them. See Connect your AWS organization.

#Data

  • In your AWS account: the second factor (authenticator app secrets, backup codes, codes by email and verified sessions), in the state bucket. Backup codes are stored as PBKDF2-HMAC-SHA256 hashes.
  • In Shonin: your Shonin org, its people, groups, permission sets, assignments and delegations. Passwords are kept by Shonin's identity service and never shown to anyone.
  • Tokens of the command line go from your installation to your computer encrypted for the shonin command: Shonin forwards them without reading them.

#Stop every sign-in at once

Disable the signing key of the installation in AWS KMS: console sign-in and new credentials stop at once. Enable it again to resume.

#Updates

The installation installs only updates signed by Polarity. See Automatic updates.

#Report a vulnerability

Write to info@polarity.dev.

View as Markdown