           │ ➖                                   ┃┠──────────────────┼──────────────────────────────────────┨

┃ CREATED_AT       │ 2023-06-15 18:45:17.822337           ┃

┠──────────────────┼──────────────────────────────────────┨

┃ UPDATED_AT       │ 2023-06-15 18:45:17.822341           ┃

┗━━━━━━━━━━━━━━━━━━┷━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛

Configuration

┏━━━━━━━━━━━━━━━━━━━━━━━┯━━━━━━━━━━━┓

┃ PROPERTY              │ VALUE     ┃

┠───────────────────────┼───────────┨

┃ region                │ us-east-1 ┃

┠───────────────────────┼───────────┨

┃ aws_access_key_id     │ [HIDDEN]  ┃

┠───────────────────────┼───────────┨

┃ aws_secret_access_key │ [HIDDEN]  ┃

┗━━━━━━━━━━━━━━━━━━━━━━━┷━━━━━━━━━━━┛

The AWS Service Connector discovered and lifted the AWS Secret Key that was configured on the local machine and securely stored it in the Secrets Store.

Moreover, the following security best practice is automatically enforced by the AWS connector: the AWS Secret Key will be kept hidden on the ZenML Server and the clients will never use it directly to gain access to any AWS resources. Instead, the AWS Service Connector will generate short-lived security tokens and distribute those to clients. It will also take care of issuing new tokens when those expire. This is identifiable from the session-token authentication method and the session duration configuration attributes.

One way to confirm this is to ask ZenML to show us the exact configuration that a Service Connector client would see, but this requires us to pick an S3 bucket for which temporary credentials can be generated:

zenml service-connector describe aws-s3 --resource-id s3://zenfiles

Example Command Output

Service connector 'aws-s3 (s3-bucket | s3://zenfiles client)' of type 'aws' with id '96a92154-4ec7-4722-bc18-21eeeadb8a4f' is owned by user 'default' and is 'private'.

'aws-s3 (s3-bucket | s3://zenfiles client)' aws Service

Connector Details

┏━━━━━━━━━━━━━━━━━━┯━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓