In my ~/.aws/credentials I have the following:
[default] aws_access_key_id = <something> aws_secret_access_key = <something-else>
This file has permissions 0600 but doesn't require anything from me if you walked up to my computer, typed on my keyboard while my back is turned, you could have these values by copying them to a thumbdrive, copying them to /tmp and grabbing them later.
ssh I have keyfiles, but the private key requires a passphrase to use it. I can do
ssh-add which will store this in memory and allow we to use ssh all day long without typing the passphrase every time. Admittedly, using
ssh-add does lower the security on my machine to that of the AWS credentials, but if I reboot, security is back in place. If my machine dies and it has to go to the shop, my ssh keys are still safe, but my aws credentials aren't.
Why is this acceptable? Why didn't AWS use an ssh type setup to begin with? Why do I need 2 factor on my AWS login if this plaintext version of my keys is sitting on my computer? Seems like there are 2 padlocks on the same door but the door is only pushed closed, not actually "locked".
Are my concerns overblown?
I know some people create ssh keys without passphrases, something I think is foolish, and something that essentially boils down to this same security-minus AWS mechanism. I'm not one of those people.