Those keys are too short to be public/private RSA keys. What are they? How does it use them to authenticate the client?
My guess is:
- AWS access key ID is a form of unique user/account identifier
- AWS secret key is like private key
- When AWS CLI sends a API request, the payload is signed by generating an HMAC with the secret key as the key
- The HMAC, AccessKeyID and the payload is sent to AWS service
- AWS service verifies the identity of the sender and integrity of the message by recomputing the HMAC code.
- If it's verified the request is accepted and processed.
Is this accurate? Why does AWS do this instead of asking user to upload a RSA public key? Why is this safer?
EDIT: I think this is how it works -- https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html#ConstructingTheAuthenticationHeader