当私钥暴露时为什么要使用 Amazon SQS
所以这可能是一个愚蠢的问题，但如果 Amazon SQS 需要私钥和公钥，那么使用它还有什么意义呢？如果客户端拥有私钥和公钥，他们可能可以通过反编译或其他方式发现密钥...
我能想到的唯一安全方法是使用具有私钥和公钥的代理（如 php）。那么首先使用 SQS 的意义何在呢？ SQS 的主要好处（我可以看到）是它可以向上扩展，并且您不必担心收到多少消息。但如果您要使用代理，那么您也必须扩展它......我希望我的担忧有意义吗？
谢谢
So this might be a silly question, but what is the point of using Amazon SQS if it requires a private and public key? If the client has the private and public key they could probably discover the keys via decompile or some other means...
The only secure way I could think of would be to use a proxy (like php) that has the private and public keys. But then what is the point of using SQS in the first place? The main benefit of SQS (I can see) is that it can scale upwards and you don't have to worry about how many messages you are receiving. But if you are going to be using a proxy then you will have to scale that too... I hope my concerns make sense?
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果您必须向客户端提供密钥才能从队列中提取数据，那么您的担忧是有道理的。然而，典型的工作流程涉及使用您的 AWS 账户 ID 创建和修改队列，并可能将数据推送到队列中。然后，您可以使用 SQS addPermission 操作设置权限或设置更精细控制的访问策略。这意味着您只能向特定 AWS 账户或匿名使用授予读取权限，但不允许进行其他修改。
所以基本上你有几个选择。您可以编译预先设置的 AWS 公钥和私钥，这些密钥对客户端应用程序具有有限的权限。我认为更好的方法是让公钥和私钥文件成为您客户端上的可配置选项，并告诉客户端用户他们负责获取自己的 AWS 帐户和密钥，他们可以告诉您他们的 AWS 密钥是什么，以及您可以根据需要对每个客户进行精细控制。
您可以查看以下资源：
Your concerns would be valid if you had to give your secret key out for clients to pull data from the queue. However the typical workflow involves using your AWS account ID for creating and modifying queues and perhaps pushing data onto the queues. Then you can set permissions with either the SQS addPermission action or setup a more finely controlled access policy. This means you would give read access to only a specific AWS account or to anonymous usage, but you would not allow for other modifications.
So basically you have a couple options. You could compile in the AWS public and private keys which you have setup in advanced that has restricted permissions on your client application. A better approach in my opinion is to make the public and private key files a configurable option on your client and tell the users of the client they are responsible for getting their own AWS account and keys and they can tell you what their AWS key is and you can give them as fine grain control as you want on a per client basis.
These resources would be good for you to look at: