How to Kill an AWS Access Key
summary
Shows how static AWS access keys get replaced by SAML + STS using AWS’s assume-role-with-saml API, Okta as the IdP, and a helper CLI (aws-okta or equivalents) wired up with Terraform. Builds a central identity account that exchanges SAML assertions for short-lived creds, moves credentials into environment vars and instance metadata, and enforces MFA. Finds onboarding drops to ~10 minutes, role chaining limits STS lifetime to 1 hour so long jobs need renewal, and a split root account serves as break‑glass. Deployment is scripted, standardized, and successful.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 2:16AWS Security Token Service
- 3:05SAML Markup Language
- 5:24API Assume Roll
- 6:52Identity Provider
- 8:40Slides
- 9:04Setting up the Identity Provider
- 9:32Copying the Identity Provider
- 9:44API Integration
- 10:22Static Access Keys
- 10:34IAM Policy
- 11:05AWS Octave
- 11:29AWS Roles
- 11:59MFA
- 12:37Execution Style
- 14:41Notes
- 16:34Lessons Learned
- 19:37Questions
related talks
21mAutomating Secure OIDC-Based Cross-Cloud Authentication
28mYour journey to temporary credentials in the cloud
23mGetting started with identity on AWS
32mAccess Keys Will Kill You Before You Kill the Password
45mManaging hybrid workloads with IAM Roles Anywhere, featuring
01h 00mAWS Identity Workshop
57mA first-principles approach: AWS Identity and Access Management (IAM)
50mDestroying Long-Lived Cloud Credentials with Workload Identity Federation