Introduction


You'll always have cases where you want to hit AWS from a home laptop or an on-prem server.

For a long time, the only way to give credentials to code running "outside AWS" was "stick an IAM User's long-lived key (AKIA...) into an env var or config file."

This sucks for a bunch of reasons.


If the long-lived key leaks, attackers...