AWS's "Secret Key" is (obviously) a secret, but should an "Access Key" alone (without the corresponding secret key) be considered a secret too?
While the AWS Access Key ID is like a username (and the Secret Access Key is like a password), the Access Key ID is also designed to be shared and AWS does this explicitly with the AWS Presigned Object URL feature as mentioned by John Hanley in a previous comment. This is an expanded response.
AWS Presigned Object URLs are shareable links designed to be given to non-authenticated users. The following is a description of AWS Presigned Object URLs from AWS docs:
All objects by default are private. Only the object owner has permission to access these objects. However, the object owner can optionally share objects with others by creating a presigned URL, using their own security credentials, to grant time-limited permission to download the objects.
AWS documentation has a lot of code to create the URLs but I couldn't find example URLs. An example Presigned Object URL is available in the following CloudBerry Lab guide showing 3 query string parameters including
- Guide: "Using Amazon S3 Pre-Signed URLs for Temporary Object Access"
- Guide URL: https://www.cloudberrylab.com/resources/blog/s3-pre-signed-url-guide/
Answer to your question is; Yes, you have to secure the access key and AWS recommends following mechanism for securing access keys:
As a security best practice, an administrator, regularly rotate (change) the access keys for IAM users in your account. Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html
You can also create and use temporary access keys, known as temporary security credentials. The advantage of temporary security credentials is that they are short term. After they expire, they're no longer valid. You can use temporary access keys in less secure environments or distribute them to grant users temporary access to resources in your AWS account. Source: https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html
Note: If you consider your Access key as user name and secret key as password. I'm sure you will not share your user name with a hacker to ease his job on hacking your account. Though AWS Access Key is not secret but should be managed as recommended by AWS.
Hope this clarifies your query.