How AWS access key id and secret access key are generated internally

Question

According to AWS's documentation, for accessing AWS resources programmatically or via CLI, you can generate an access key in AWS console like:

Access Key ID: AKIAIOSFODNN7EXAMPLE

Secret Access Key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

And it is said in the doc:

6. Choose Download Credentials, and store the keys in a secure location.

Your secret key will no longer be available through the AWS Management Console; you will have the only copy.

Since AWS doesn't store the secret access key, I wonder how the (access key id, secret access key) could be generated internally and how an API/CLI access could be authenticated securely.

I am thinking that AWS may:

• generate an access key id randomly
• use an internal key in AWS with some crypto algorithm to generate the secret access key
• when authenticating a request, apply the same internal key and same algorithm to the access key id, and verify if the computed result is the secret access key

But I am far from a security expert, and would like to know how this could be done in AWS in production. Thanks.

Answer 1

From the documentation [0][1], we see that you prove to AWS that you know the Secret Access Key using HMAC, not using Digital Signatures. This means that when verifying the authentication, AWS must be able to generate the exact Secret Access Key for your Access Key ID.

Thus, their promise to never show you the Secret Access Key again is a matter of policy, not a truth about the underlying technology. If it was public key cryptography and the Secret Access Key was a private key that corresponded to the Access Key ID which was a public key, and they only stored the public key, they truly would not be able to regenerate and show the private key. But that would require the client to generate a private key signature to authenticate requests, which is slow and less portable than HMAC.

I have no evidence for this, but I believe the Secret Access Key is generated using HMAC from the Access Key ID, using a key that is available only to Amazon. Stealing that key without Amazon noticing would enable you to forge anyone's Secret Access Key given only their Access Key ID. If ever the AWS key is stolen, AWS would have to invalidate all keys and cause massive global downtime while everyone generates new ones on the AWS console and redeploys. I don't know what safeguards they took to make this unlikely, but I assume the key can't reside on a single HSM per Availability Zone, because it is required to process every non-public request.

Alternatively, the Secret Access Key might be random and stored alongside the Access Key ID in the AWS authentication & authorization system, which is replicated to every availability zone. That would mean that to cause a catastrophe, someone would need to exfiltrate a big chunk of data, not a single secret key.

0 - https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html#ConstructingTheAuthenticationHeader

1 - https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html#RESTAuthenticationExamples