1

On developers machines, when using aws --configure and s3cmd configure, the AWS key and secret are stored in a plain text file.

For security reasons I'd like the secret, at least, to be kept in a secure and encrypted way, using MAC keychain for example.

Env variables don't seem like a solution as they would also need to be kept securely.

Is there any way to store the keys in a secure way?

(As a side note, no need to mention that all machines have passwords and the keys have the minimum needed permissions in AWS and there are other security methods in place.)

4
  • What is the threat vector that you're trying to secure against?
    – kdgregory
    Oct 21, 2018 at 15:00
  • Stealing keys, the same reason as you store passwords encrypted
    – SimonW
    Oct 21, 2018 at 15:04
  • Who steals those keys? Are you concerned about someone losing their laptop, or about a person inside your company that sees an unattended laptop and cats the config file? Or something else?
    – kdgregory
    Oct 21, 2018 at 15:13
  • 1
    My point is that, depending on the vector, you may want to take different approaches to security. For example, is it reasonable to require your developers to hit a website to get security credentials for their session? How about if those credentials only last an hour?
    – kdgregory
    Oct 21, 2018 at 15:14

2 Answers 2

0

Instead of long-term credentials (AWS IAM Access Keys), you can use short-term credentials by leveraging AWS SSO & AWS Organizations. The short-term credentials are not encrypted though, but temporarily valid (can be configured).

see https://latanassov.dev/aws/2020-01-23/aws-sso-aws-cli.html

1
  • the link is down.
    – bebbi
    Jan 23, 2023 at 10:04
0

I'm using the credential_process key in my ~/.aws/config file as a way to achieve this. You set it to a command to run that will print the credentials to stdout. I'm using a bash script around pass, but you can use whatever you want.

For example, we'll configure a profile simonw by setting this in ~/.aws/config

[profile simonw]
credential_process = get-my-creds-cmd
output = json

...then we need that get-my-creds-cmd command to exist on the $PATH, or you can reference it with an absolute path. We'll create the command as a bash script:

#!/bin/bash
accessKey=AKIA...  # TODO get this from somewhere secure
secretKey=...      # TODO get this from somewhere secure

cat << HEREDOC
{
  "Version": 1,
  "AccessKeyId": "$accessKey",
  "SecretAccessKey": "$secretKey"
}
HEREDOC

Make sure that bash script is on the $PATH and chmod +x it so it can be executed.

Now we can test it works

aws sts get-caller-identity --profile simonw

If you implemented the bash script to read MAC Keychain, you might get prompted for a password to unlock the keychain.

I got this idea from this blog. Also, here's the official AWS docs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.