Is BLESS still maintained by Netflix?

No, Netflix has archived BLESS and moved it to an archived OSS project state, meaning they no longer plan to maintain it. It's available for reference but not recommended for new projects due to lack of support.

BLESS vs AWS Systems Manager Session Manager for SSH access

BLESS issues short-lived SSH certificates for traditional SSH access with IAM controls, while Session Manager provides a managed, browser-based shell without SSH keys. BLESS offers more control but is archived and complex, whereas Session Manager is a fully managed AWS service.

How to deploy BLESS in multiple AWS regions?

You need to deploy the Lambda function in each region, encrypt the CA key password with KMS keys per region, and update the bless_deploy.cfg accordingly. The README specifies using KMS to encrypt passwords for each region individually.

What are good alternatives to BLESS for SSH certificates?

Alternatives include HashiCorp Vault with SSH secrets engine, Smallstep SSH CA, or native OpenSSH certificate features. These options often provide active maintenance, broader platform support, and simpler setups compared to BLESS.

Can BLESS generate certificates for SSH hosts?

Yes, BLESS supports host certificate generation through the bless_lambda_host.lambda_handler_host handler, as mentioned in the deployment section. This allows signing SSH public keys for servers, not just user access.

How to rotate SSH CA keys with BLESS?

BLESS supports multiple CA keys for rotation by provisioning offline keys and updating the TrustedUserCAKeys file on servers. The README recommends keeping multiple keys offline until ready to rotate to simplify the process.

Open-Awesome

bless

Apache-2.0Python0.4.0

An SSH Certificate Authority that runs as an AWS Lambda function for ephemeral, IAM-controlled SSH access.

GitHub

2.8k stars228 forks0 contributors

What is bless?

BLESS is an SSH Certificate Authority that operates as an AWS Lambda function to sign SSH public keys. It solves the problem of managing SSH access at scale by issuing short-lived, IAM-restricted certificates instead of relying on static authorized_keys files or shared private keys. This provides a secure, auditable method for granting ephemeral SSH access to servers.

Target Audience

DevOps engineers and security teams managing SSH access in AWS environments, particularly those using bastion hosts or requiring fine-grained, IAM-integrated access controls.

Value Proposition

Developers choose BLESS for its serverless, scalable design that integrates tightly with AWS IAM for authorization, eliminating key management overhead while providing short-lived certificates that enhance security. Its isolated deployment model protects CA keys, making it a robust solution for enterprise SSH access management.

Overview

Repository for BLESS, an SSH Certificate Authority that runs as a AWS Lambda function

Use Cases

Best For

Securing SSH access to EC2 instances via IAM roles
Replacing bastion host key management with certificate-based auth
Implementing short-lived SSH credentials for compliance
Managing SSH access in multi-account AWS environments
Automating SSH certificate issuance in CI/CD pipelines
Reducing risk from static SSH keys in distributed teams

Not Ideal For

Organizations not using AWS or planning a multi-cloud strategy
Teams requiring actively maintained software with regular updates and support
Environments with minimal SSH access needs where static key management suffices
Projects needing quick setup without complex IAM and KMS configuration

Pros & Cons

Pros

Serverless Scalability

Runs as an AWS Lambda function, eliminating server management and auto-scaling, as described in the deployment section for reduced operational overhead.

IAM Integration

Uses AWS IAM policies to restrict certificate issuance, enabling fine-grained, role-based access control aligned with AWS permissions.

Short-Lived Certificates

Issues ephemeral SSH certificates with limited validity, reducing risk from key exposure and enhancing security through temporary credentials.

Isolated Deployment

Designed for a dedicated AWS account to protect CA private keys, leveraging AWS isolation for enhanced security, as emphasized in the philosophy.

Cons

Archived Project

Netflix has archived BLESS and no longer maintains it, meaning no future updates, bug fixes, or security patches, as stated in the README header.

Complex Setup

Deployment requires multiple steps like compiling dependencies in Docker, managing KMS keys, and configuring IAM roles, which can be error-prone and time-consuming.

AWS Lock-in

Heavily reliant on AWS services (Lambda, IAM, KMS), making migration difficult and unsuitable for hybrid or non-AWS environments.

Frequently Asked Questions

Related Projects

Algo

Set up a personal VPN in the cloud

Stars30,367

Forks2,367

Last commit6 days ago

checkov

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.

Stars8,987

Forks1,403

Last commit3 days ago

s2n

An implementation of the TLS/SSL protocols

Stars4,761

Forks800

Last commit8 hours ago

security_monkey

Security Monkey monitors AWS, GCP, OpenStack, and GitHub orgs for assets and their changes over time.

Stars4,371

Forks779

Last commit5 years ago

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub