What process periodically validate a users account

When you use AWS programmatically, you provide your AWS access keys so that AWS can verify your identity in programmatic calls. Your access keys consist of an access key ID (for example, AKIAIOSFODNN7EXAMPLE) and a secret access key (for example, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY).

Anyone who has your access keys has the same level of access to your AWS resources that you do. Consequently, AWS goes to significant lengths to protect your access keys, and, in keeping with our shared-responsibility model, you should as well.

The steps that follow can help you protect your access keys. For background information, see AWS security credentials.

Your organization may have different security requirements and policies than those described in this topic. The suggestions provided here are intended as general guidelines.

Protect or don't create your root user access key

You must use an access key (access key ID plus secret access key) to make programmatic requests to AWS. For example, when using the AWS Command Line Interface, an AWS SDK, or direct API calls. Anyone who has the access keys for your AWS account root user has unrestricted access to all resources in your AWS account, including billing information. You can't reduce the permissions associated with the access key for the AWS account root user.

For more information, see Lock away your AWS account root user access keys in the IAM User Guide.

Manage access keys for IAM users

Instead of sharing the credentials of the AWS account root user, create individual IAM users, granting each user only the permissions they require. For more information, see Managing Access Keys for IAM Users in the IAM User Guide.

Observe these precautions when using access keys:

• Don't embed access keys directly into code. The AWS SDKs and the AWS Command Line Tools enable you to put access keys in known locations so that you do not have to keep them in code.

  Put access keys in one of the following locations:

  • The AWS credentials file. The AWS SDKs and AWS CLI automatically use the credentials that you store in the AWS credentials file.

    For information about using the AWS credentials file, see the documentation for your SDK. Examples include Set up AWS Credentials and Region for Development in the AWS SDK for Java Developer Guide and Configuration and Credential Files in the AWS Command Line Interface User Guide.

    To store credentials for the AWS SDK for .NET and the AWS Tools for Windows PowerShell, we recommend that you use the SDK Store. For more information, see Using the SDK Store in the AWS SDK for .NET Developer Guide.

  • Environment variables. On a multitenant system, choose user environment variables, not system environment variables.

    For more information about using environment variables to store credentials, see Environment Variables in the AWS Command Line Interface User Guide.

• Rotate access keys periodically. Change access keys on a regular basis. For details, see Rotating Access Keys (AWS CLI, Tools for Windows PowerShell, and AWS API) in the IAM User Guide and How to Rotate Access Keys for IAM Users on the AWS Security Blog.

• Remove unused access keys. If a user leaves your organization, remove the corresponding IAM user so that the user can no longer access your resources. To find out when an access key was last used, use the GetAccessKeyLastUsed API (AWS CLI command: aws iam get-access-key-last-used).

• Configure multi-factor authentication for your most sensitive operations. For more information, see Using Multi-Factor Authentication (MFA) in AWS in the IAM User Guide.

Use IAM roles instead of long-term access keys

In many scenarios, you don't need long-term access keys that never expire (as you have with an IAM user). Instead, you can create IAM roles and generate temporary security credentials. Temporary security credentials consist of an access key ID and a secret access key, but they also include a security token that indicates when the credentials expire.

Long-term access keys, such as those associated with IAM users and AWS account root users, remain valid until you manually revoke them. However, temporary security credentials obtained through IAM roles and other features of the AWS Security Token Service expire after a short period of time. Use temporary security credentials to help reduce your risk in case credentials are accidentally exposed.

Use an IAM role and temporary security credentials in these scenarios:

• You have an application or AWS CLI scripts running on an Amazon EC2 instance. Do not use access keys directly in your application. Don't pass access keys to the application, embed them in the application, or let the application read access keys from any source. Instead, define an IAM role that has appropriate permissions for your application and launch the Amazon EC2 instance with roles for EC2. Doing this associates an IAM role with the Amazon EC2 instance. This practice also enables the application to get temporary security credentials that it can in turn use to make programatic calls to AWS. The AWS SDKs and the AWS CLI can get temporary credentials from the role automatically.

• You need to grant cross-account access. Use an IAM role to establish trust between accounts, and then grant users in one account limited permissions to access the trusted account. For more information, see Tutorial: Delegate Access Across AWS Accounts Using IAM Roles in the IAM User Guide.

• You have a mobile app. Do not embed access keys with the app, even in encrypted storage. Instead, use Amazon Cognito to manage user identities in your app. This service lets you authenticate users using Login with Amazon, Facebook, Google, or any OpenID Connect (OIDC)–compatible identity provider. You can then use the Amazon Cognito credentials provider to manage credentials that your app uses to make requests to AWS. For more information, see Using the Amazon Cognito Credentials Provider on the AWS Mobile Blog.

• You want to federate into AWS and your organization supports SAML 2.0. If you work for an organization that has an identity provider that supports SAML 2.0, configure the provider to use SAML. You can use SAML to exchange authentication information with AWS and get back a set of temporary security credentials. For more information, see About SAML 2.0-based Federation in the IAM User Guide.

• You want to federate into AWS and your organization has an on-premises identity store. If users can authenticate inside your organization, you can write an application that can issue them temporary security credentials for access to AWS resources. For more information, see Creating a URL that Enables Federated Users to Access the AWS Management Console (Custom Federation Broker) in the IAM User Guide.

Access the mobile app using AWS access keys

You can access a limited set of AWS services and features using the AWS mobile app. The mobile app helps you support incident response while on the go. For more information and to download the app, see AWS Console Mobile Application.

You can sign in to the mobile app using your console password or your access keys. As a best practice, do not use root user access keys. Instead, we strongly recommend that in addition to using a password or biometric lock on your mobile device, you create an IAM user to manage AWS resources. If you lose your mobile device, you can remove the IAM user's access. For more information about generating access keys for an IAM user, see Managing Access Keys for IAM Users in the IAM User Guide.

To sign in using access keys (mobile app)

1. Open the app on your mobile device.

2. If this is the first time that you're adding an identity to the device, choose Add an identity and then choose Access keys.

   If you have already signed in using another identity, choose the menu icon and choose Switch identity. Then choose Sign in as a different identity and then Access keys.

3. On the Access keys page, enter your information:

   • Access key ID – Enter your access key ID.

   • Secret access key – Enter your secret access key.

   • Identity name – Enter the name of the identity that will appear in the mobile app. This does not need to match your IAM user name.

   • Identity PIN – Create a personal identification number (PIN) that you will use for future sign-ins.

     If you enable biometrics for the AWS mobile app, you will be prompted to use your fingerprint or facial recognition for verification instead of the PIN. If the biometrics fail, you might be prompted for the PIN instead.

4. Choose Verify and add keys.

   You can now access a select set of your resources using the mobile app.

Learn more

For more information about best practices for keeping your AWS account secure, see the following resources: