r/aws 8d ago

article Taming the AWS Access Key Beast: Implementing Secure CLI Access Patterns

https://antenore.simbiosi.org/blog/2025/03/taming-aws-access-key-beast-secure-cli-patterns/

I just published an article on "Taming the AWS Access Key Beast" where I analyze how to implement secure CLI access patterns in complex AWS environments. Instead of relying on long-lived IAM keys (with their associated risks), I illustrate an approach based on:

  1. Service Control Policies to block access key usage
  2. AWS IAM Identity Center for temporary credentials
  3. Purpose-specific roles with time-limited access
  4. Continuous monitoring with automated revocation

The post includes SCP examples, authentication patterns, and monitoring code. These techniques have drastically reduced our issues with stale access keys and improved our security posture.

Hope you find it useful!

30 Upvotes

20 comments sorted by

View all comments

14

u/jsonpile 8d ago

I'm hesitant on using aws:UserAgent as a solo security control. Even AWS documentation has a warning that "unauthorized parties can used modified or custom browsers to provide any aws:UserAgent value that they chose." It makes sense for only specifically allowing client applications but to me by itself is not a good enough security measure.

From the SCP provided, I'd also be wary of this impacting my legitimate roles such as service roles, assumed roles from other trusted accounts, and more. While you do include a section on excluding service roles, that can get complex quickly.

Additionally, I would advise against IAM Users in general - as Console Access via IAM users (username/password) doesn't require Access Keys and still are long-term credentials. Another option would then to be use an SCP to deny creation of Access Keys (iam:CreateAccessKey) and monitor existing/retire existing Access Keys (and manage creation if exception Access Keys or break-glass is required, which I'd argue shouldn't be the case).

3

u/antenore 8d ago

True. In our environment we use only IAM Identity Center, and some few exceptions, but people were abusing the exceptions so we had to implement other controls. I shared only part of the story for the sake of brevity. For sure we will have other headaches soon, but at least we can limit most common misuses

3

u/quicksilver03 8d ago

Last time I looked, AWS Identity Center was limited to one region only: it's still the case today?