An SSH Certificate Authority that runs as an AWS Lambda function for ephemeral, IAM-controlled SSH access.
BLESS is an SSH Certificate Authority that operates as an AWS Lambda function to sign SSH public keys. It solves the problem of managing SSH access at scale by issuing short-lived, IAM-restricted certificates instead of relying on static authorized_keys files or shared private keys. This provides a secure, auditable method for granting ephemeral SSH access to servers.
DevOps engineers and security teams managing SSH access in AWS environments, particularly those using bastion hosts or requiring fine-grained, IAM-integrated access controls.
Developers choose BLESS for its serverless, scalable design that integrates tightly with AWS IAM for authorization, eliminating key management overhead while providing short-lived certificates that enhance security. Its isolated deployment model protects CA keys, making it a robust solution for enterprise SSH access management.
Repository for BLESS, an SSH Certificate Authority that runs as a AWS Lambda function
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Runs as an AWS Lambda function, eliminating server management and auto-scaling, as described in the deployment section for reduced operational overhead.
Uses AWS IAM policies to restrict certificate issuance, enabling fine-grained, role-based access control aligned with AWS permissions.
Issues ephemeral SSH certificates with limited validity, reducing risk from key exposure and enhancing security through temporary credentials.
Designed for a dedicated AWS account to protect CA private keys, leveraging AWS isolation for enhanced security, as emphasized in the philosophy.
Netflix has archived BLESS and no longer maintains it, meaning no future updates, bug fixes, or security patches, as stated in the README header.
Deployment requires multiple steps like compiling dependencies in Docker, managing KMS keys, and configuring IAM roles, which can be error-prone and time-consuming.
Heavily reliant on AWS services (Lambda, IAM, KMS), making migration difficult and unsuitable for hybrid or non-AWS environments.