Cloud Worker Token Activation Protocol
Part of #538 (closed):
Storing credentials in cloud "user-data" risks exposure to untrusted code running on the instance.
Typically in clouds, user-data is provided to the instance on an internal IP, visible only to the instance, e.g. http://169.254.169.254/latest/user-data
In !1682 (merged), we provide cloud workers with a pre-enabled worker token using user-data. The metadata endpoint is firewalled off, but we can do better than this.
Our plan is to have an activation key, provided in user-data, that can be used to immediately activate a single worker key, when the worker starts up.
Edited by Stefano Rivera