Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse engineered to get the credentials, which can then be misused.

Though I find this information everywhere, but am unable to find a definitive solution to this problem. What are my options? I read about the token vending machine architecture for temporary credentials, but I am not convinced that it is any better. If I can reverse engineer the secret key, then I can reverse engineer the code which requests for temporary credentials. And once I have a set of temporary credentials to access S3, I am as good as if I had the key. I can request the temporary credentials again and again, even if they expire pretty quickly. To summarize, if an app can do something, I can do the same as a malicious user. If anything, the TVM can be a bit better at management (rotating credentials, and changing key in case of breach, etc.). Please note we can put the same access restrictions on the secret key, as we plan to do in case of TVM temporary credentials.

Additionally, if Amazon doesn't want people to use the secret key directly in the App, why don't they block it in their SDK, and enforce TVM or the correct solution. If you will leave a path, people are going to use it. I read several articles like these, and wonder why?: http://blog.rajbala.com/post/81038397871/amazon-is-downloading-apps-from-google-play-and

Please help me understand if this is better, and whether there is a perfect (or may be good) solution available to this problem. I do get that TVM is more manageable (and much faster incident response once the credentials are compromised), but I am not convinced that it is more secure.

PS: This is mostly related to anonymous TVM, as users don't log in to our apps.

PS2: I am clear about the secure communication between TVM and app to get temp credentials, post the app registers. I am more concerned about what would prevent a malicious user from registering with a new UDID, and obtaining temporary credentials, and hence S3 access.

  • 2
    The article you linked to linked to this article at Amazon: Using temporary security credentials, so that appears to be Amazon's recommended solution. I don't think there's an answer to "How do I give the user an app that has permission to do something without giving a malicious user that controls the app permission to do that same thing". I'd look at restricting the access to resources that the app has to limit the damage that a malicious user could do. – Johnny Apr 1 '14 at 20:42
  • WIF (the link) requires authentication using an identity provider, and isn't for anonymous users. But yes, I do get your point about restricting access to minimize damage. – amit_saxena Apr 1 '14 at 22:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.