I stumbled upon https://github.com/pda/aws-keychain.

The aim of aws-keychain is to run commands that require AWS credentials without ever storing those credentials unencrypted on disk. Mac OS X's keychain is used for storage, and credentials are passed to commands via the well known environment variables that all tools look for.

I thought it was pretty cool, but it made me wonder if the trouble was worth it. The only way someone would ever have access to those keys would be if they gained physical access to your computer, and at that point, you're screwed to the point where it'd be safer to invalidate those keys anyways.

It's not that I think it's a bad idea, but it seems like a marginal security improvement at best. Am I missing something?

  • Your computer might also be someone elses computer. So if you have several accounts and passwords its important some other user can't get those files, say a school or work computer compared to a personal computer that only you use. – daniel Mar 19 '17 at 8:45
  • As far as I am concerned with security and specialy the privacy part, I trust more my own system than any cloud storage. They will probably ignore my data, but how many people can read it because of their admin priviledge? And as they are visible systems, how can I know the security procedures they use? Unless I can answer those 2 questions I prefere relying on my own security practices... – Serge Ballesta Mar 19 '17 at 9:46

That depends, as always, on your threat model.

A malicious application running as your unprivileged user will be able to read your stored AWS credentials and either use them directly or ship them off to a remote server. If you're not particularly concerned with that (eg you carefully vet all the software you run), then feel free to ignore that.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.