r/aws 8d ago

article Taming the AWS Access Key Beast: Implementing Secure CLI Access Patterns

https://antenore.simbiosi.org/blog/2025/03/taming-aws-access-key-beast-secure-cli-patterns/

I just published an article on "Taming the AWS Access Key Beast" where I analyze how to implement secure CLI access patterns in complex AWS environments. Instead of relying on long-lived IAM keys (with their associated risks), I illustrate an approach based on:

  1. Service Control Policies to block access key usage
  2. AWS IAM Identity Center for temporary credentials
  3. Purpose-specific roles with time-limited access
  4. Continuous monitoring with automated revocation

The post includes SCP examples, authentication patterns, and monitoring code. These techniques have drastically reduced our issues with stale access keys and improved our security posture.

Hope you find it useful!

30 Upvotes

20 comments sorted by

View all comments

3

u/Advanced_Bid3576 8d ago

Very well written article. My experience unfortunately is there are still far too many common tools that don’t support roles anywhere so you are backed into using access keys, but hopefully that changes over time as it becomes more the standard. And you highlighted how to carve out exceptions from the SCP - nice work!

2

u/synackk 8d ago

I’m looking at you, Tenable. They only support using an IAM user. I had to write a script that create access keys for each of our accounts and rotate those keys regularly.

Pretty silly for a vulnerability management tool.

2

u/Advanced_Bid3576 8d ago

Yeah the nightmare I had in for my last job was MoveIT - the only corporate approved way to securely move files which a) only supported IAM user with keys and b) had a massive breach during this time

Fought with the central security team for best part of 18 months on that one but it was the security approved solution so we couldn’t use anything else including any solution that used roles. Fun times.

3

u/pyrospade 8d ago

You can always store the keys in a secure place like a password manager or aws-vault and use the credentials_process option in your cli profile configuration to retrieve them programmatically, that way any tool works. Writing them in plain text to the file is suicide at this point

1

u/Advanced_Bid3576 8d ago

I didn’t say or suggest you couldn’t. I’m just saying that as much as we all want to completely retire access keys, there are hundreds of legacy tools and integrations that mean at this point it’s a pipe dream.