Access Key
Identity & AccessAn Access Key consists of two parts: an access key ID (starts with AKIA) and a secret access key. Together they authenticate programmatic requests to AWS APIs - CLI commands, SDK calls, and HTTP requests.
Access keys are long-term credentials that do not expire unless explicitly deactivated or deleted. This makes them a significant security risk: if leaked (in a Git commit, a log file, or a misconfigured server), an attacker has persistent access until the key is revoked.
Security Best Practices
- Use IAM roles with temporary credentials instead of access keys wherever possible
- Never embed access keys in application code or commit them to version control
- Rotate keys regularly (90 days maximum per CIS benchmark)
- Use
aws:SecureTransportcondition to require HTTPS - Monitor for unused or old keys with IAM Credential Reports and Access Advisor
Related AWS Services
Related Terms
Short-lived AWS credentials (access key, secret key, session token) issued by STS that expire automatically, eliminating the risk of permanent credential exposure.
An AWS identity with temporary credentials that can be assumed by users, services, or applications to perform actions without long-term access keys.
The practice of regularly replacing access keys, passwords, and secrets with new values to limit the window of exposure if a credential is compromised.
The practice of securely storing, accessing, and rotating sensitive data like API keys, database passwords, and tokens using services like AWS Secrets Manager.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.