On Tue, Feb 25, 2020 at 04:21:05PM -0000, Balint Reczey wrote: > This is a temporary key and it is indeed available to everyone being > able to run curl on the system: > https://www.reddit.com/r/aws/comments/85vkq6/question_about_accesskeyid_secretaccesskey_in/ > > The package does not change the availability of the key, so I believe > this is not a concern regarding the package, but a general concern > regarding EC2 instances.
Excellent, this is exactly the confirmation that this is expected. > Can I take this as an OK for the MIR, from the Security Team? Yes, security team ACK for promoting ec2-instance-connect to main, with the understanding that it shouldn't be seeded in generic media. Thanks -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1835114 Title: [MIR] ec2-instance-connect To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ec2-instance-connect/+bug/1835114/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
