Give services the identity of their machine

How to do it

Attach a role to the server, container task or function. The cloud SDK's default credential chain finds it without any code. Give each service its own role. Outside a cloud, use workload identity federation where the platform offers it, before reaching for a key file.

Example

// The SDK finds the role attached to the machine. No key in code or settings.
import { S3Client, GetObjectCommand } from '@aws-sdk/client-s3';

const s3 = new S3Client({});
const invoice = await s3.send(new GetObjectCommand({ Bucket: 'example-shop-invoices', Key: 'A-1042.pdf' }));

import boto3

s3 = boto3.client("s3")
invoice = s3.get_object(Bucket="example-shop-invoices", Key="A-1042.pdf")

# Fails when a service carries a static cloud key
! tr '\0' '\n' < "/proc/$(systemctl show -p MainPID --value shop)/environ" | grep -E '^AWS_SECRET_ACCESS_KEY='

How to check

The running service's environment holds no AWS_SECRET_ACCESS_KEY, and no GOOGLE_APPLICATION_CREDENTIALS that points to a key file. Its calls appear in the audit log under its role.