Access Keys Will Kill You Before You Kill the Password
summary
Claim: long‑lived AWS access keys are the weakest link, widely stored in plaintext and shared, and possession gives unconditional API access. Practical fix: enforce MFA for API calls with an IAM deny-if-no-mfa policy that checks aws:MultiFactorAuthAge (demo uses an 8‑hour window). Tools released: an MFA-enabler that writes aws_mfa_serial to credentials, an init-session tool that exchanges keys+MFA for short STS creds (those start with ASIA), and a rotate-my-key script that creates and deletes keys; these work together to enforce and automate MFA-protected API access.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:42Welcome
- 2:26Agenda
- 3:07Security
- 4:18Strong Access Controls
- 5:36AWS
- 6:12Security Issues
- 8:47Access Keys
- 11:17MFA Policies
- 15:43Better Workflow
- 16:43New Policies
- 22:10Save MFA Serial
- 22:41You Need SCS Session
- 23:35MFA Changes
- 24:35AWS API CLI
- 25:07RotateMyKey
- 26:27Conclusion
- 27:18Questions
related talks
25mHow to Kill an AWS Access Key
28mYour journey to temporary credentials in the cloud
26mHow To Keep A Secret
38mChanging Perspectives: A Deep Dive into the Security Posture of 600+ Real-World AWS Environments
51mUsing Key Management Service for data protection
26mBuilding Blocks of Security: Using passkeys to protect user access
39mAPI = Authentication’s Poorly Implemented
56mLock That Sh*t Down!