Question/answer one by one:
- AWS access key ID is a form of unique user/account identifier
- Correct, AWS access key is a unique identifier for a user. BTW, in some cases, it could be considered as sensitive data, sharing access key can lead to tracking like who accesses which systems and when, check this post for more details.
If you are an administrator, regularly rotate the access keys for IAM users
- AWS secret key is like private key
- Correct, consider your Access key as user name and Secret key as the password.
- When AWS CLI sends a API request, the payload is signed by generating an HMAC with the secret key as the key
- The HMAC, AccessKeyID and the payload is sent to AWS service
aws-cli using signing API Requests technique. It sends
HTTP Authorization header with the next payload:
- Algorithm you used for signing (AWS4-HMAC-SHA256)
- Credential scope (with your access key ID)
- List of signed headers
- Calculated signature. The signature is based on your request information, and you use your AWS secret access key to produce the signature. The signature confirms your identity to AWS.
GET https://iam.amazonaws.com/?Action=ListUsers&Version=2010-05-08 HTTP/1.1
Authorization: AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/iam/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=5d672d79c15b13162d9279b0855cfba6789a8edb4c82c400e06b5924a6f2b5d7
content-type: application/x-www-form-urlencoded; charset=utf-8
Another option is to use a query string, in this case, the content of
HTTP Authorization header will be encoded in URL.
aws sdk already provide these steps under the hood.
But if you want to make your own software for low level interacting with AWS, follow these steps:
Under the hood, tools like
aws-cli rely on
boto-core. Here you can find the implementation of steps above.
- AWS service verifies the identity of the sender and integrity of the message by recomputing the HMAC code.
- If it's verified the request is accepted and processed.
- Both statements are correct.
Why does AWS do this instead of asking user to upload a RSA public key?
More or less I agree with @Lothar's reflections.