Identify access keys by name, not by id - #27
Merged
Conversation
The credentials table led with the twenty-character MB… id and kept the operator's own label in a secondary Description column, so the one string that says what a key is for was the one nobody read first. The name now leads, with the id under it — still monospace, still selectable, because it is what a client's configuration holds. AccessKeyRecord::description becomes ::name and the console returns `name`. The stored encoding is positional and unchanged, so existing keys read back with their text intact and no record version moves. Creation still accepts `description` so a script written against the last release keeps labelling its keys instead of silently minting anonymous ones. Credential audit entries record the name beside the id, which stops resolving to anything the moment the key is revoked — precisely when somebody reads the log to see what was destroyed. A key with no name falls back to its id everywhere rather than rendering a blank row.
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The credentials table led with the twenty-character MB… id and kept the operator's own label in a secondary Description column, so the one string that says what a key is for was the one nobody read first. The name now leads, with the id under it — still monospace, still selectable, because it is what a client's configuration holds.
AccessKeyRecord::description becomes ::name and the console returns
name. The stored encoding is positional and unchanged, so existing keys read back with their text intact and no record version moves. Creation still acceptsdescriptionso a script written against the last release keeps labelling its keys instead of silently minting anonymous ones.Credential audit entries record the name beside the id, which stops resolving to anything the moment the key is revoked — precisely when somebody reads the log to see what was destroyed.
A key with no name falls back to its id everywhere rather than rendering a blank row.