When creating a new user in AWS IAM, it generates access keys for that user. Where is a secure and readily accessible location to store these credentials?
1
-
1We need more information about those users. Those IAM users are managed by real users or 3rd party users? are integrated into some automatic processes, CD pipelines...?– RuBiCKCommented Mar 15, 2019 at 8:29
Add a comment
|
3 Answers
Well there are a lot of places to keep them secure
you can use something like hashicorp vault to keep those kind of secrets
you can use something like lastpass and my personal favorite is enpass
But first you need to define your needs so you can choose the right tool to use and integrate with your daily use
Keepas can be another option where you can store your secret keys/passwords . Here is the document document for your reference : https://aws.amazon.com/marketplace/pp/prodview-wr72ujcv4dhmo
In case you can provision the IAM accounts programmatically, for example using Terraform, you could ask users for their PGP public keys (or fetch them from company's PGP server) and encrypt their credentials immediately upon provisioning with PGP.
You can then safely distribute the encrypted credentials to the user, however you see fit, store them in Keepass/1password/other password manager where you can share them with the users, or just leave the encrypted credentials in CI pipeline and send them via encrypted private messenger without compromising security.
