I just spoke with a friend who works at a major telecom company and she said they only give them temporary AWS credentials (that start with ASIA*) AND they change the credentials every 30 mins. Is this unusual? How on earth are you supposed to work with a temporary STS key?

I only use temporary keys but not sure if that's the same thing

Does it start with AKIA or ASIA?

no but it only lasts 1 hour

It's not an AWS access key?

That sounds terrible and is terrible. We generate STS keys that last 24 hours, if you generate them with your AWS credentials. But if you generate via email/pw, a new teammate found it resets every hour. He thought this was the norm for a whole month 🥲. Terrible experience though and a huge deep focus interruption.

I use AWS SSO which I login to once a day (expires every 12 hours) That allows continuous regeneration of STS tokens for 12 hours (they're valid for 1 hour)

nice, that's been recommended once before, we'll have to try.

@thdxr I have NO clue about AWS SSO at all. I have a root account that’s locked down with MFA (I don’t use that acct), and an IAM user that I personally use to sign into the console & do dev stuff. is this not ideal?

If I put my "AWS nerd" hat on - yes it's not ideal. IAM no longer is recommended for humans because they issue long lived credentials and from an organizational perspective it's a bit challenging to control access + define policies centrally. AWS SSO is actually a really good service (rare for AWS lol). You can use it standalone or link it with your SSO provide (I use google workspaces) so people can sign in with the same credentials they use to sign in for everything else. Then they can generate short lived credentials (if they leak they expire within an hour anyway) that are used to assume roles in your various AWS accounts. AWS SSO does a good job hiding this complexity and it feels pretty seamless in most places. One rough area is not all of aws-sdk knows how to refresh tokens from AWS sso yet so there's a small additionally helper you'll need but other than that I love it

wow, sounds pretty good! so with SSO, I won’t need an IAM user?

That's right - you can define roles in AWS SSO + who has access to assume them. It'll take care of mirroring that role in each aws account and allowing you to assume it

I’ve used SSO too, it really makes sense improving the security with temporary keys

+1 for using SSO. Definitely the recommended approach from a security/best practices/usability perspective

cool! I’ll look into it tomorrow. I found on AWS blog post on hooking up SSO with Google Workspace

oh really? i will search that for sure

@Carlos Daniel https://aws.amazon.com/blogs/security/how-to-use-g-suite-as-external-identity-provider-aws-sso/

can you send the blog post you mentioned on the other day?

super easy

ah thanks