Preface:
I use a windows EC2 instance with a role attached that allows it access to specific AWS Secrets Manager secrets. We never use access keys directly. The app running on the instance needs to be able to pull these secrets.
The end-user of this instance is currently required to RDP into that instance in order to perform their task. The end user is never directly aware that they can access the secrets manager secrets, but it's possible.
The end-user is accessing a CLI app and a website that runs locally on the EC2 machine.
Problem:
Since the instance has a role that allows it to see secrets, the end-user can use the AWS cli or curl etc while in an RDP session to retrieve secrets that they weren't supposed to be able to directly access.
Question:
How do I prevent the end-user from being able to access secrets, while allowing the instance the freedom it needs to perform its function? Is there something that can be done in terms of user permissions on the instance? Any alternative solutions?
