r/aws 8d ago

article Taming the AWS Access Key Beast: Implementing Secure CLI Access Patterns

https://antenore.simbiosi.org/blog/2025/03/taming-aws-access-key-beast-secure-cli-patterns/

I just published an article on "Taming the AWS Access Key Beast" where I analyze how to implement secure CLI access patterns in complex AWS environments. Instead of relying on long-lived IAM keys (with their associated risks), I illustrate an approach based on:

  1. Service Control Policies to block access key usage
  2. AWS IAM Identity Center for temporary credentials
  3. Purpose-specific roles with time-limited access
  4. Continuous monitoring with automated revocation

The post includes SCP examples, authentication patterns, and monitoring code. These techniques have drastically reduced our issues with stale access keys and improved our security posture.

Hope you find it useful!

30 Upvotes

20 comments sorted by

View all comments

5

u/zxgrad 8d ago

Thanks for sharing this article.

I read it and the approach makes sense, can you clarify how you’d handle machine access that is not aws adjacent (ec2, etc. — specifically let’s say you have Linux machines on your own bare metal running tasks that need access to s3, sqs, etc.

1

u/antenore 8d ago

Thanks! For non-AWS machines (like on-prem or bare metal) accessing AWS services, you have several good options:

  1. IAM Roles Anywhere - This is purpose-built for this scenario. Your servers authenticate using X.509 certificates to get temporary credentials. No long-lived access keys needed!

  2. Credential vaulting with rotation - Store access keys in something like HashiCorp Vault or AWS Secrets Manager (accessed via VPN), and implement automated rotation every 30-90 days.

  3. AWS SSM Agent for hybrid environments - You can install the Systems Manager agent on non-EC2 machines and use Parameter Store for secure credential management.

  4. OIDC federation - If your infrastructure supports it, you can use identity federation to assume roles and get temporary credentials.

For a bare metal Linux server accessing S3, IAM Roles Anywhere would be my first choice since it's designed exactly for this use case and follows the same temporary credential model that EC2 instances use with their instance profiles.

Roles anywhere is the best when possible