AWS Access Key Alternatives: Comparing OIDC, IAM Roles Anywhere, and Systems Manager Hybrid Activation
Summary
The article compares OIDC, IAM Roles Anywhere, and Systems Manager hybrid activation as alternatives to long-lived AWS access keys, outlining security trade-offs and possible improvements such as hardware-backed signing.
Key points
- OIDC can let workloads in other clouds or GitHub Actions assume an AWS IAM role; trust policies should restrict the permitted subject to prevent unauthorized users or repositories from assuming it.
- IAM Roles Anywhere uses certificates instead of access keys, but its credential helper reads certificates from disk, where they may be exposed through file reads, source control, or backups.
- The article describes hardware-backed signing through TPMs or YubiKeys as a potential improvement, and notes that IAM Roles Anywhere lacks PKCS11 support.
- Systems Manager hybrid activation uses a short-lived, one-time activation code and device fingerprinting to register remote systems.
- Hybrid activation stores fingerprint data and private keys on disk, and its temporary AWS session credentials are stored in /root/.aws/credentials; those credentials expire.
- The author favors hybrid activation for small, one-off integrations and IAM Roles Anywhere for larger deployments requiring granular certificate-based policies.
Article Details
- Topic
- Alternatives to long-lived AWS IAM access keys, including OIDC, IAM Roles Anywhere, and Systems Manager hybrid activation
People
Vendors
Products
ECS AnywhereRoles Anywhere, it is a technology that is worthy of consideration and is used behind the scenes for ECS Anywhere and is part of IoT Greengrass. The key components of this mechanism are an activation code and the useIAM Roles Anywherephysical device access to your AWS environment, the two primary solutions offered by AWS are IAM Roles Anywhere and Systems Manager hybrid activation. IoT Greengrassthat is worthy of consideration and is used behind the scenes for ECS Anywhere and is part of IoT Greengrass. The key components of this mechanism are an activation code and the use of device fingerprinting.OpenID Connect (OIDC)resource in another cloud provider (e.g. GCP or Azure) needs to interact with your AWS resources, OpenID Connect (OIDC) may be used. With this solution, you configure an IAM role in your environment to trust theSystems Manageraccess to your AWS environment, the two primary solutions offered by AWS are IAM Roles Anywhere and Systems Manager hybrid activation.
Tools
awsaccountcredsThese APIs are best documented by Aidan Steele in a different repo of his, awsaccountcreds, for an entirely different use case of SSM (Default Host Management Configuration). cloudkeywithout being able to be extracted. A researcher named Aidan Steele created an open-source tool called cloudkey that accomplishes this with a yubikey and the aforementioned iot:AssumeRoleWithCertificate call withoutrolesanywhere-credential-helperThe utility that AWS provides for Roles Anywhere, rolesanywhere-credential-helper, is limited to only being able to access the certificate from a file on disk. The danger of storing the certificate on disk is that if an