Access Key & Secret Key

Short Definition

Think of access key as your username and secret key as your password — but for programs, not humans. They let your code talk to cloud services (AWS, Azure, GCP) without logging in through a browser.

Full Definition

Access keys are credential pairs used for programmatic authentication to cloud platforms:

Components:

• Access Key ID: Public identifier (like username) - AKIAIOSFODNN7EXAMPLE
• Secret Access Key: Private key (like password) - wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

Types:

• Long-term: Created manually, never expire (risky)
• Temporary: Issued by STS, expire automatically (safer)

Usage:

1aws s3 ls --access-key AKIA... --secret-key wJalr...

Why It Matters

• Required for all programmatic cloud access
• Equivalent to root passwords if compromised
• Often hardcoded in code (bad practice)
• Primary target in cloud breaches

How Attackers Use It

• Steal from IMDS via SSRF
• Find in public GitHub repos
• Extract from exposed .env files
• Discover in Docker images or logs
• Use to access entire cloud infrastructure

Once stolen, attackers can:

• List all resources
• Access S3 buckets
• Launch new instances
• Modify security groups
• Create backdoor accounts

How to Detect or Prevent It

Prevention:

• Never hardcode in source code
• Use IAM roles instead of long-term keys
• Rotate keys regularly (90 days max)
• Apply least privilege permissions
• Use AWS Secrets Manager or similar
• Enable MFA for sensitive operations
• Scan repositories with tools like GitGuardian

Detection:

• Monitor for keys used from unusual locations
• Alert on new key creation
• Track API calls by key
• Check for keys in public repos (GitHub alerts)
• Analyze access patterns for anomalies

Common Misconceptions

• "Temporary keys are safe to expose" - Still dangerous while valid
• "Deleting code removes leaked keys" - Git history keeps them
• "Keys in private repos are safe" - Repos can be compromised
• "IAM roles don't use keys" - They do, but temporary ones

Real-World Example

Uber Breach (2016)

• Developers stored AWS keys in private GitHub repo
• Attacker gained access to repo
• Used keys to access S3 bucket containing 57M records
• Cost: $148M fine

Travis CI Leak (2021)

• Thousands of access keys exposed in logs
• Affected open-source and private projects
• Keys had varying levels of access

Related Terms

Credentials, IMDS, API, Cloud Infrastructure, IAM