// the find
Netflix/bless
Repository for BLESS, an SSH Certificate Authority that runs as a AWS Lambda function
BLESS is Netflix's SSH Certificate Authority that runs as an AWS Lambda function, issuing short-lived SSH certificates instead of managing authorized_keys files across a fleet. It's for teams running infrastructure on AWS who want to gate SSH access through IAM roles rather than distributing SSH keys. Netflix has since archived it, explicitly recommending you look elsewhere.
The IAM-as-authorization model is the right idea — tying SSH access to IAM roles means your existing AWS permission boundaries carry over to SSH without a separate ACL system. KMS-encrypted CA private key stored in Lambda means the key never touches disk on a general-purpose machine. The kmsauth integration adds a second factor by requiring a KMS-signed token, so a stolen AWS credential alone isn't enough. Test coverage is solid for a security-critical Lambda — the test suite covers certificate parsing, key formats, and request validation directly.
Archived by Netflix in 2024, with the README explicitly pointing you away from it — this is a dead project, not a stable one. Python 3.7/3.8 target is EOL and the Lambda runtime it was built for is deprecated; running this today means fighting the runtime upgrade yourself. The client is described as a 'proof of concept,' meaning you're writing your own SSH client wrapper for actual production use. Configuration is entirely file-based (a .cfg bundled into the Lambda zip), so rotating the CA key or changing config requires a full redeploy, which is awkward for something this security-sensitive.