Intro
Point of view...
You joined a Zoom call and begin to share your screen to walk a customer through a task, but you forgot that in the top corner is your account ID, along with your account name and the federated user you signed in as.
This is also a pain when recording your screen for a tutorial or walk through because you'll have to go back and blur the sensitive account information.
How about when you switch over to an AWS resource showing it's ARN that has your account number tucked inside it where anyone can read it.
This is not necessarily a disaster, since an account ID isn't a password and can't be used to log in by itself. However, it's information you probably did not mean to hand out, and scrubbing it after the fact is tedious.
So I built a simple Chrome extension that takes care of that for you.
What it does
The extension swaps the sensitive text in the AWS console for asterisks, which means you can share your screen without stopping to think about what is visible.
With no setup at all, it hides your account ID in both the plain 123456789012 form and the dashed 1234-5678-9012 form. It also hides any ARN wherever one appears.
On top of that, it hides your account name and whichever federated user, IAM user, or assumed role you signed in with. Those values are not fixed patterns and are really just text that is unique to you, so the extension figures them out by reading whatever sits next to AWS's own labels in the account menu. Once you open menu once, it handles the rest from there, including the account tab up in the top navigation bar.
Here's the account menu after masking:
Here's a service dashboard (e.g. CloudFront) with the ARN masked out:
Everything happens locally inside your browser and nothing is ever sent anywhere, and flipping the extension off puts all the original text back right away.
Get it running in Chrome
You can find the repo over at https://github.com/rextheking/aws-console-privacy
Start by downloading the repo. You can clone it with the command below, or you can grab the ZIP from GitHub and unzip it wherever you like.
git clone https://github.com/rextheking/aws-console-privacy.git
Once you have the folder, open chrome://extensions in Chrome and turn on Developer mode using the toggle in the top right.
After that, click Load unpacked and point it at the aws-console-privacy folder you just downloaded.
Once loaded it should see it in your extensions as show in the following image.
That is all it takes, and the extension is now installed.
Using it
Open the AWS console and click your account menu one time so the extension can learn your account name and the federated user you are signed in as. From that point on the sensitive parts show up as asterisks whenever you are in the console.
Anytime you want to adjust things, click the extension icon to open the popup. Select the extensions and locate the switch that turns it on or off.
There are checkboxes if you want finer control over what gets masked. If something rare slips through, the popup also has an Advanced box where you can add any extra term you want hidden.
The caveat
This is a visual mask and nothing more. It covers what is on the screen, which is exactly what we want when you are sharing or recording. It does not touch the underlying page data or the network responses behind it, so it is best thought of as a way to keep your account details out of frame rather than as a real security control.
Reach for it during the demo but lean on proper IAM and secret handling for the serious protection.
If it saves you some hassle, give the repo a star and pass it along to anyone who lives in the AWS console. Issues and pull requests are always welcome.
Top comments (0)