Disable programmatic access to AWS
Can we disable programmatic access using access key / secret key to the entire account? In case there is a security breach and the access key and secret key is exposed to the outside world, can the AWS account administrator freeze the programmatic access to the AWS account?
amazon-web-services amazon-iam aws-iam
asked Jan 1 at 1:20
John JaiJohn Jai
79411327
add a comment |
Can we disable programmatic access using access key / secret key to the entire account? In case there is a security breach and the access key and secret key is exposed to the outside world, can the AWS account administrator freeze the programmatic access to the AWS account?
amazon-web-services amazon-iam aws-iam
asked Jan 1 at 1:20
John JaiJohn Jai
79411327
add a comment |
Can we disable programmatic access using access key / secret key to the entire account? In case there is a security breach and the access key and secret key is exposed to the outside world, can the AWS account administrator freeze the programmatic access to the AWS account?
amazon-web-services amazon-iam aws-iam
asked Jan 1 at 1:20
John JaiJohn Jai
79411327
Can we disable programmatic access using access key / secret key to the entire account? In case there is a security breach and the access key and secret key is exposed to the outside world, can the AWS account administrator freeze the programmatic access to the AWS account?
amazon-web-services amazon-iam aws-iam
amazon-web-services amazon-iam aws-iam
asked Jan 1 at 1:20
John JaiJohn Jai
79411327
asked Jan 1 at 1:20
John JaiJohn Jai
79411327
asked Jan 1 at 1:20
John JaiJohn Jai
79411327
asked Jan 1 at 1:20
John JaiJohn Jai
79411327
asked Jan 1 at 1:20
John JaiJohn Jai
79411327
79411327
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
You can disable or delete an Access Key. You must disable access keys one at a time. There is no "global" disable or delete for access keys.
There are several types of Access Keys:
- AWS Root User Access Keys. You should not be using these keys. If you are, issue IAM User Access Keys and delete the root keys.
- IAM User Access Keys. These are the key types that you should use for normal access.
- Temporary Access Keys. These keys are generated by Roles or Simple Token Service (STS). These keys are temporary and expire.
Managing Access Keys for Your AWS Account Root User
Managing Access Keys for IAM Users
Revoking IAM Role Temporary Security Credentials
answered Jan 1 at 1:49
John HanleyJohn Hanley
16.1k2629
Thanks, so we can't disable all the access keys but only those we know is exposed right? Is there any disable for all access keys of an account?
– John Jai
Jan 1 at 1:55
2
You must disable access keys one at a time. There is no "global" disable or delete for access keys. TIP: You should not be creating access keys that have access to everything in your account. You should be using Least Privilege to only issue access keys with the privileges they need. If your programs are running in the cloud, don't use access keys at all and instead use IAM Roles.
– John Hanley
Jan 1 at 2:01
Thanks, that answers my original question - no "global" disable. And that's a great tip. Can you please edit your answer to include this statement, so I can mark it as accepted?
– John Jai
Jan 1 at 2:18
@JohnJai - Updated my answer with your suggestion.
– John Hanley
Jan 1 at 2:31
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53992484%2fdisable-programmatic-access-to-aws%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
You can disable or delete an Access Key. You must disable access keys one at a time. There is no "global" disable or delete for access keys.
There are several types of Access Keys:
- AWS Root User Access Keys. You should not be using these keys. If you are, issue IAM User Access Keys and delete the root keys.
- IAM User Access Keys. These are the key types that you should use for normal access.
- Temporary Access Keys. These keys are generated by Roles or Simple Token Service (STS). These keys are temporary and expire.
Managing Access Keys for Your AWS Account Root User
Managing Access Keys for IAM Users
Revoking IAM Role Temporary Security Credentials
answered Jan 1 at 1:49
John HanleyJohn Hanley
16.1k2629
Thanks, so we can't disable all the access keys but only those we know is exposed right? Is there any disable for all access keys of an account?
– John Jai
Jan 1 at 1:55
2
You must disable access keys one at a time. There is no "global" disable or delete for access keys. TIP: You should not be creating access keys that have access to everything in your account. You should be using Least Privilege to only issue access keys with the privileges they need. If your programs are running in the cloud, don't use access keys at all and instead use IAM Roles.
– John Hanley
Jan 1 at 2:01
Thanks, that answers my original question - no "global" disable. And that's a great tip. Can you please edit your answer to include this statement, so I can mark it as accepted?
– John Jai
Jan 1 at 2:18
@JohnJai - Updated my answer with your suggestion.
– John Hanley
Jan 1 at 2:31
add a comment |
You can disable or delete an Access Key. You must disable access keys one at a time. There is no "global" disable or delete for access keys.
There are several types of Access Keys:
- AWS Root User Access Keys. You should not be using these keys. If you are, issue IAM User Access Keys and delete the root keys.
- IAM User Access Keys. These are the key types that you should use for normal access.
- Temporary Access Keys. These keys are generated by Roles or Simple Token Service (STS). These keys are temporary and expire.
Managing Access Keys for Your AWS Account Root User
Managing Access Keys for IAM Users
Revoking IAM Role Temporary Security Credentials
answered Jan 1 at 1:49
John HanleyJohn Hanley
16.1k2629
Thanks, so we can't disable all the access keys but only those we know is exposed right? Is there any disable for all access keys of an account?
– John Jai
Jan 1 at 1:55
2
You must disable access keys one at a time. There is no "global" disable or delete for access keys. TIP: You should not be creating access keys that have access to everything in your account. You should be using Least Privilege to only issue access keys with the privileges they need. If your programs are running in the cloud, don't use access keys at all and instead use IAM Roles.
– John Hanley
Jan 1 at 2:01
Thanks, that answers my original question - no "global" disable. And that's a great tip. Can you please edit your answer to include this statement, so I can mark it as accepted?
– John Jai
Jan 1 at 2:18
@JohnJai - Updated my answer with your suggestion.
– John Hanley
Jan 1 at 2:31
add a comment |
You can disable or delete an Access Key. You must disable access keys one at a time. There is no "global" disable or delete for access keys.
There are several types of Access Keys:
- AWS Root User Access Keys. You should not be using these keys. If you are, issue IAM User Access Keys and delete the root keys.
- IAM User Access Keys. These are the key types that you should use for normal access.
- Temporary Access Keys. These keys are generated by Roles or Simple Token Service (STS). These keys are temporary and expire.
Managing Access Keys for Your AWS Account Root User
Managing Access Keys for IAM Users
Revoking IAM Role Temporary Security Credentials
answered Jan 1 at 1:49
John HanleyJohn Hanley
16.1k2629
You can disable or delete an Access Key. You must disable access keys one at a time. There is no "global" disable or delete for access keys.
There are several types of Access Keys:
- AWS Root User Access Keys. You should not be using these keys. If you are, issue IAM User Access Keys and delete the root keys.
- IAM User Access Keys. These are the key types that you should use for normal access.
- Temporary Access Keys. These keys are generated by Roles or Simple Token Service (STS). These keys are temporary and expire.
Managing Access Keys for Your AWS Account Root User
Managing Access Keys for IAM Users
Revoking IAM Role Temporary Security Credentials
answered Jan 1 at 1:49
John HanleyJohn Hanley
16.1k2629
edited Jan 1 at 2:30
answered Jan 1 at 1:49
John HanleyJohn Hanley
16.1k2629
answered Jan 1 at 1:49
John HanleyJohn Hanley
16.1k2629
answered Jan 1 at 1:49
John HanleyJohn Hanley
16.1k2629
16.1k2629
Thanks, so we can't disable all the access keys but only those we know is exposed right? Is there any disable for all access keys of an account?
– John Jai
Jan 1 at 1:55
2
You must disable access keys one at a time. There is no "global" disable or delete for access keys. TIP: You should not be creating access keys that have access to everything in your account. You should be using Least Privilege to only issue access keys with the privileges they need. If your programs are running in the cloud, don't use access keys at all and instead use IAM Roles.
– John Hanley
Jan 1 at 2:01
Thanks, that answers my original question - no "global" disable. And that's a great tip. Can you please edit your answer to include this statement, so I can mark it as accepted?
– John Jai
Jan 1 at 2:18
@JohnJai - Updated my answer with your suggestion.
– John Hanley
Jan 1 at 2:31
add a comment |
Thanks, so we can't disable all the access keys but only those we know is exposed right? Is there any disable for all access keys of an account?
– John Jai
Jan 1 at 1:55
2
You must disable access keys one at a time. There is no "global" disable or delete for access keys. TIP: You should not be creating access keys that have access to everything in your account. You should be using Least Privilege to only issue access keys with the privileges they need. If your programs are running in the cloud, don't use access keys at all and instead use IAM Roles.
– John Hanley
Jan 1 at 2:01
Thanks, that answers my original question - no "global" disable. And that's a great tip. Can you please edit your answer to include this statement, so I can mark it as accepted?
– John Jai
Jan 1 at 2:18
@JohnJai - Updated my answer with your suggestion.
– John Hanley
Jan 1 at 2:31
Thanks, so we can't disable all the access keys but only those we know is exposed right? Is there any disable for all access keys of an account?
– John Jai
Jan 1 at 1:55
Thanks, so we can't disable all the access keys but only those we know is exposed right? Is there any disable for all access keys of an account?
– John Jai
Jan 1 at 1:55
2
2
You must disable access keys one at a time. There is no "global" disable or delete for access keys. TIP: You should not be creating access keys that have access to everything in your account. You should be using Least Privilege to only issue access keys with the privileges they need. If your programs are running in the cloud, don't use access keys at all and instead use IAM Roles.
– John Hanley
Jan 1 at 2:01
You must disable access keys one at a time. There is no "global" disable or delete for access keys. TIP: You should not be creating access keys that have access to everything in your account. You should be using Least Privilege to only issue access keys with the privileges they need. If your programs are running in the cloud, don't use access keys at all and instead use IAM Roles.
– John Hanley
Jan 1 at 2:01
Thanks, that answers my original question - no "global" disable. And that's a great tip. Can you please edit your answer to include this statement, so I can mark it as accepted?
– John Jai
Jan 1 at 2:18
Thanks, that answers my original question - no "global" disable. And that's a great tip. Can you please edit your answer to include this statement, so I can mark it as accepted?
– John Jai
Jan 1 at 2:18
@JohnJai - Updated my answer with your suggestion.
– John Hanley
Jan 1 at 2:31
@JohnJai - Updated my answer with your suggestion.
– John Hanley
Jan 1 at 2:31
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53992484%2fdisable-programmatic-access-to-aws%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
