This application uses AWS SDK for Browser to fetch information of your resources. In other words, it is the user's browser that makes the network request to the AWS APIs. Therefore credentials that required to access the AWS APIs need to be made available to the browser. The credentials are stored with your Confluence instance. When AWS SDK make requests, the Macro load the credentials and use that to sign the requests. So the credentials is not transmitted via network. Our recommendation is to use credentials that grant only the minimum access. In all cases, a read-only access to the resource is sufficient. You can also limit it to only having permissions to access only part of your resources. To summarise: - Credentials are stored within your confluence instance and are used to sign the request sent to AWS.
- Credentials will be made available to the AWS SDK running in the browser, so it is possible to access them from the browsers developer tools.
- Credentials is not sent to any third party (including AWS server, AWS Widgets server).
- Make sure to use least privileged permissions (readonly).
|