Search for a command to run...
In this article, we'll learn about the two types of AWS Access keys which can be used to programmatically access the AWS resources.
I am a Cloud Engineer working at AWS to help customers maintain security in the cloud.
Love to play with JavaScript in my free time and write about my learnings to make your tech journey smoother and productive!
No comments yet. Be the first to comment.
Amazon Web Services is the most popular and comprehensive cloud service provider. In this series, I will write about various concepts and services in AWS to help you understand it better.
In this article, we'll learn about the AWS CLI prompt feature which allows to autocomplete the AWS CLI commands to minimize documentation reference.
In this article, we'll learn about the AWS CLI prompt feature which allows to autocomplete the AWS CLI commands to minimize documentation reference.
You'll learn how to generate MFA authenticated temporary credentials to pass the MFA check while using AWS CLI to access the AWS resources.
You'll learn how you can secure your AWS resources using MFA when being accessed using the AWS Console or AWS CLI.
AWS require different types of security credentials depending upon how we are going to access the AWS resources i.e.
AWS Management Console - requires user name and password
Programmatic access (CLI/SDK/API) - requires access keys
Access keys are a type of AWS credential which are used to sign programmatic requests. These requests can be generated using any of the following methods:
The Access keys generally consist of two parts:
However, there can be a third part called "Session Token". We will discuss more about this in our post.
Access keys can be classified into two types depending upon the time for which they are valid i.e.
1) Long Term Access Keys
2) Temporary Access Keys
As the name suggests, the long term access keys are programmatic credentials which are valid forever, until they are explicitly deleted from our AWS account. This type of key is a long term customer-managed credential which is associated with an IAM user or AWS account root user.
A sample long term access key is as follows:
We can assign up to two access keys per user (root user or IAM user). This allows the user to easily rotate the keys and meet their security standards.
Refer the AWS documentation "Managing access keys for IAM users" to create long term access keys for your user using Console/CLI/API.
However, using long term credentials is not always the ideal approach, in cases where you want to give someone limited period access to your AWS resources. This brings us to the other type of access key i.e. temporary access key.
As you might have already guessed by the name, these keys are valid for a short period of time. So, once these keys are expired, they can no longer be used to access any AWS resources. These keys are generated using the AWS Security Token Service (STS).
A sample temporary access key is as follows
The "Session Token" plays the most important role in the temporary access keys. So, when we make a call using a temporary access key, the call must include the session token. AWS uses the session token to validate the temporary security credentials and confirm if these credentials are expired or not.
These keys are generally used in following scenarios:
For more details around the common scenarios for using temporary credentials, please refer the AWS documentation here.
Also, refer the "Requesting temporary security credentials" AWS documentation to get details around all the possible ways to generate temporary credentials in AWS.
Now let's assume the following scenario:
I am using temporary access keys to interact with my AWS resources via CLI. However, instead of configuring all the three parts of the access key, I excluded the "SessionToken" from the CLI configuration. So...
Q. How will now AWS know if I am using temporary credentials?
Q. Will this make my credentials long term instead of temporary?
Give it a thought. The answer to this is in the blog's title 🤔
Lets discuss that now 👇
If you have not already noticed, the first four characters of the Access Key ID helps us to determine the type of access key:
So, this allows AWS to determines the type of access key when the requests comes in to access any AWS resource.
In case you are using temporary access key i.e. a key starting with "ASIA", AWS would except the session token to be the third parameter in the credentials. In case the session token is missing, you would get an error for not using valid credentials.
đź‘‹ Enjoyed the article? Reach out to me anytime in the comments below or on Twitter for any further discussion or feedback.