Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Repository for BLESS, an SSH Certificate Authority that runs as a AWS Lambda function
| Date | Stars |
|---|---|
| 2026-07-24 | 2758 |
| 2026-07-25 | 2758 |
| 2026-07-28 | 2758 |
| 2026-07-30 | 2758 |
| 2026-08-06 | 2758 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
0.0
growth rate 0.00%/day
# Archived
With the existence of more SSH certificate tools since the release of BLESS, and better SSH access management from AWS, we're moving BLESS to the archived OSS project state. This means we no longer plan to maintain the project, but will be keeping it public for others who may still use it.
# BLESS - Bastion's Lambda Ephemeral SSH Service
[](https://travis-ci.org/Netflix/bless) [](https://coveralls.io/github/Netflix/bless) [](https://gitter.im/Netflix/bless?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge) []()
BLESS is an SSH Certificate Authority that runs as an AWS Lambda function and is used to sign SSH
public keys.
SSH Certificates are an excellent way to authorize users to access a particular SSH host,
as they can be restricted for a single use case, and can be short lived. Instead of managing the
authorized_keys of a host, or controlling who has access to SSH Private Keys, hosts just
need to be configured to trust an SSH CA.
BLESS should be run as an AWS Lambda in an isolated AWS account. Because BLESS needs access to a
private key which is trusted by your hosts, an isolated AWS account helps restrict who can access
that private key, or modify the BLESS code you are running.
AWS Lambda functions can use an AWS IAM Policy to limit which IAM Roles can invoke the Lambda
Function. If properly configured, you can restrict which IAM Roles can request SSH Certificates.
For example, your SSH Bastion (aka SSH Jump Host) can run with the only IAM Role with access to
invoke a BLESS Lambda Function configured with the SSH CA key trusted by the instances accessible
to that SSH Bastion.
## Getting Started
These instructions are to get BLESS up and running in your local development environment.
### Installation Instructions
Clone the repo:
$ git clone [email protected]:Netflix/bless.git
Cd to the bless repo:
$ cd bless
Create a virtualenv if you haven't already:
$ python3.8 -m venv venv
Activate the venv:
$ source venv/bin/activate
Install package and test dependencies:
(venv) $ make develop
Run the tests:
(venv) $ make test
## Deployment
To deploy an AWS Lambda Function, you need to provide a .zip with the code and all dependencies.
The .zip must contain your lambda code and configurations at the top level of the .zip. The BLESS
Makefile includes a publish target to package up everything into a deploy-able .zip if they are in
the expected locations. You will need to setup your own Python 3.7 lambda to deploy the .zip to.
Previously the AWS Lambda Handler needed to be set to `bless_lambda.lambda_handler`, and this would generate a user
cert. `bless_lambda.lambda_handler` still works for user certs. `bless_lambda_user.lambda_handler_user` is a handler
that can also be used to issue user certificates.
A new handler `bless_lambda_host.lambda_handler_host` has been created to allow for the creation of host SSH certs.
All three handlers exist in the published .zip.
### Compiling BLESS Lambda Dependencies
To deploy code as a Lambda Function, you need to package up all of the dependencies. You will need to
compile and include your dependencies before you can publish a working AWS Lambda.
BLESS uses a docker container running [Amazon Linux 2](https://hub.docker.com/_/amazonlinux) to package everything up:
- Execute ```make lambda-deps``` and this will run a container and save all the dependencies in ./aws_lambda_libs
### Protecting the CA Private Key
- Generate a password protected RSA Private Key in the PEM format:
```
$ ssh-keygen -t rsa -b 4096 -m PEM -f bless-ca- -C "SSH CA Key"
```
- **NExcerpt of 9,045 characters
Read on GitHub
81
Jorge Dias · http://aerisnova.com
12
5
3
2
Ben Bridts · Cloudar · Belgium
2
2
2
2
1
1
1
Gábor Lipták
1
1
The Gitter Badger · Gitter
1
Darío Hereñú
1
1
1
1
1
Would you bet a product on this? Bounded 0–100 and slow moving.
matched fp:189e96b12c119cb7, topic:serverless