# S3 シークレットアクセスキーの公開

**URL:** https://meta.discourse.org/t/disclosure-of-s3-secret-access-key/87221
**Category:** Feature
**Created:** [2018 年 5 月 10 日午後 11:47 UTC](https://meta.discourse.org/t/disclosure-of-s3-secret-access-key/87221 "2018-05-10T23:47:06Z")
**Posts on this page:** 4
**Page:** 2

<div class="post-metadata">

### Author: ![Asher\_Densmore-Lynn](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/asher_densmore-lynn/32/244555_2.png) [@Asher\_Densmore-Lynn](https://meta.discourse.org/u/Asher_Densmore-Lynn)
#### Post date: [2018 年 5 月 15 日午前 5:12 UTC](https://meta.discourse.org/t/disclosure-of-s3-secret-access-key/87221/21 "2018-05-15T05:12:45Z")

</div>

Yeah – I’ve got a thread elsewhere where I’m being persnickety about exactly what the permissions the S3 user should have. (Though now that I’m reminded this is a thing, there’s no reason I shouldn’t add an IP blocker to the role.) Far as security goes, anybody able to execute code as Discourse’s user can, well, execute code as Discourse’s user, so they’re as likely to be able to grab the credentials from Discourse as they are the instance metadata.

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [2018 年 5 月 15 日午前 6:28 UTC](https://meta.discourse.org/t/disclosure-of-s3-secret-access-key/87221/22 "2018-05-15T06:28:14Z")

</div>

Exactly, and then @techAPJ you can use this site setting `type` to automatically set the type of the input to `password` to hide the content and add a Show value button that will toggle the type of the input 😉

---

<div class="post-metadata">

### Author: ![techAPJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/techapj/32/342990_2.png) [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [2018 年 6 月 4 日午後 4:36 UTC](https://meta.discourse.org/t/disclosure-of-s3-secret-access-key/87221/24 "2018-06-04T16:36:56Z")

</div>

This is now done via:

[https://github.com/discourse/discourse/commit/46fc57222f24add74d2d075eb36663565967622c](https://github.com/discourse/discourse/commit/46fc57222f24add74d2d075eb36663565967622c)

Demo:

[https://global.discourse-cdn.com/meta/original/3X/b/5/b5a5376bc74624701a9b895f95cc01907c5adafb.mov](https://global.discourse-cdn.com/meta/original/3X/b/5/b5a5376bc74624701a9b895f95cc01907c5adafb.mov)

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2018 年 11 月 27 日午後 4:44 UTC](https://meta.discourse.org/t/disclosure-of-s3-secret-access-key/87221/25 "2018-11-27T16:44:39Z")

</div>



[Previous page](https://meta.discourse.org/t/disclosure-of-s3-secret-access-key/87221.md?page=1)