This article was translated with the help of AI.

Are you issuing access keys just to use the AWS CLI?

I used to do exactly that. Access keys are convenient, aren't they?

Once you set them up with aws configure, they keep working forever.

But behind that convenience lies a scary story.

A leak can mean a bill of tens of thousands of dollars, leaked data, and lost trust. And once it's out, you can't take it back.

This article covers how to deal with access keys, how to stop using them, and how to keep them from leaking.

What Are Access Keys?

Let's quickly review what access keys are.

Once you authenticate in the browser, it automatically sets up temporary credentials for you.

It works with the same feel as aws sso login, which you use in environments that have IAM Identity Center.

It's a good fit for environments where "setting up IAM Identity Center is overkill."

With this, running your operations without access keys becomes easy to achieve.

CI/CD Uses OIDC

This is the case for CI/CD like GitHub Actions.

Instead of registering an access key in Secrets, you use OIDC.

When you attach a role, temporary credentials are handed over automatically, so you don't need to hold an access key.

On-Prem and External Servers Use IAM Roles Anywhere

This is the case for operating from on-prem or servers outside AWS.

Instead of distributing an access key, you use IAM Roles Anywhere.

On the server side, GitHub's Push Protection.

It blocks changes that contain secrets at the moment you push.

If It Does Leak

If it does leak, the first response is what counts.

🚨 If a secret leaks, revoke it immediately, before you even think about deleting the commit.

Git keeps history, so deleting the commit is meaningless.

Once you revoke it, the value left in the history can no longer be used.

Summary

• There are alternatives for getting off access keys


• There are also situations where you can't stop using them


• Defend against leaks with three layers

Security is the foundation of business. That said, don't overthink it. Just start with aws login right at hand.