According to AWS's documentation, for accessing AWS resources programmatically or via CLI, you can generate an access key in AWS console like:
Access Key ID: AKIAIOSFODNN7EXAMPLE
Secret Access Key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
And it is said in the doc:
- Choose Download Credentials, and store the keys in a secure location.
Your secret key will no longer be available through the AWS Management Console; you will have the only copy.
Since AWS doesn't store the secret access key, I wonder how the (access key id, secret access key) could be generated internally and how an API/CLI access could be authenticated securely.
I am thinking that AWS may:
- generate an access key id randomly
- use an internal key in AWS with some crypto algorithm to generate the secret access key
- when authenticating a request, apply the same internal key and same algorithm to the access key id, and verify if the computed result is the secret access key
But I am far from a security expert, and would like to know how this could be done in AWS in production. Thanks.