About this question
AWS's "Secret Key" is (obviously) a secret, but should an "Access Key" alone (without the corresponding secret key) be considered a secret too?
AWS's "Secret Key" is (obviously) a secret, but should an "Access Key" alone (without the corresponding secret key) be considered a secret too?
Log in to share your answer and help other learners.
Log in to answerBest Answer · By JanBask Cyber Security Expert
Answered on Sep 23, 2022
While the AWSAccessKeyID is like a username (and the Secret Access Key is like a password), the Access Key ID is also designed to be shared and AWS does this explicitly with the AWS Pre Signed Object URL feature as mentioned by John Hanley in a previous comment. This is an expanded response.
AWS Pre Signed Object URLs are shareable links designed to be given to non-authenticated users. The following is a description of AWS Pre Signed Object URLs from AWS docs:
All objects by default are private. Only the object owner has permission to access these objects. However, the object owner can optionally share objects with others by creating a pre-signed URL, using their own security credentials, to grant time-limited permission to download the objects.
Ref: https://docs.aws.amazon.com/AmazonS3/latest/dev/ShareObjectPreSignedURL.html
AWS documentation has a lot of code to create the URLs but I couldn't find example URLs. An example Pre Signed Object URL is available in the following CloudBerry Lab guide showing 3 query string parameters including AWSAccessKeyId, Signature and Expires.
https://cloudberry-examples.s3.amazonaws.com/invoices/user1234/july2018.pdf?AWSAccessKeyId=AKIALGKOKBY37F5FZF4I&Signature=bPSs8Kcak/gjEqqjOO5cFS022x0=&Expires=1531446995
Guide: "Using Amazon S3 Pre-Signed URLs for Temporary Object Access"
Guide URL: https://www.cloudberrylab.com/resources/blog/s3-pre-signed-url-guide/
Free tutorials and interview questions from industry experts — learn the skill, then get ready to prove it.
Step-by-step Cyber Security guides from industry experts
Common Cyber Security interview questions, answered
Guides, tips and career advice on Cyber Security from JanBask experts.
Cyber Security Ethical Hacker Roles and Responsibilities: What Do Ethical Hackers Actually Do?
What does an ethical hacker actually do? See the five-phase process, daily tasks, required skills, and where ethical hackers work.
Cyber Security Penetration Tester Roles and Responsibilities: What Does a Pen Tester Do?
Learn what a penetration tester does, including key roles, responsibilities, daily tasks, tools, skills, reporting, and…
Cyber Security GRC Analyst Roles and Responsibilities: What Does a GRC Analyst Do?
What does a GRC analyst actually do? See the core responsibilities, how they grow by experience level, a daily routine, tools,…
Cyber Security SOC Analyst Roles and Responsibilities: What Does a SOC Analyst Do?
What does a SOC analyst actually do? Explore core responsibilities, the Tier 1–3 structure, daily tasks, tools, and skills in…