AWS WITHOUT ACCESS KEYS

Summary from the TLDR InfoSec newsletter

Fly.io operates a custom OIDC IdP that allows apps running in Fly Machines to access AWS services without a user needing to directly interact with AWS. Fly utilizes a custom init server that fly machines boot into, which exposes a Unix socket to access the Fly Machine API that contains the OIDC information. Fly then detects if an AWS_ROLE_ARN is set and if so, generates an OIDC token, saves it to a file, and sets the appropriate environment variables for the AWS SDK.