1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Amazon AWS access keys

Discussion in 'BlackHat Lounge' started by thaqu, May 4, 2016.

  1. thaqu

    thaqu Registered Member

    Joined:
    Oct 13, 2014
    Messages:
    73
    Likes Received:
    78
    Hey folks, a quick question for these veteran amazon affiliates out there. Have you ever used one of the 1-click-import themes or plug-ins? I was looking at a few different ones but they all seem to require that you put in your AWS access ID and secret access key. However, Amazon strongly advises against sharing those information with anyone including embedding them in third party applications. According to Amazon the access ID and secret access key can be used to see your billing information including credit card numbers etc.

    Does any of this hold any truth? If so, is there a work around? Setting up amazon associates seem so painless with 1clicks imports but if it means giving free access to my credit card number to complete strangers I think I'll have to pass :(

    Any advise?
     
  2. kahuna74

    kahuna74 Regular Member

    Joined:
    Aug 19, 2014
    Messages:
    270
    Likes Received:
    102
    Gender:
    Male
    Occupation:
    Software Developer
    Location:
    Grand Rapids, MI
    Any way that you can read the source code of the plug before installing it to see what it does with your credentials? There are a lot of 3rd party apps that require an amazon access key and secret. I don't give mine out before I know exactly what they're being used for.
     
  3. ChrisX

    ChrisX Jr. VIP Jr. VIP

    Joined:
    Oct 8, 2011
    Messages:
    273
    Likes Received:
    139
    Gender:
    Male
    Home Page:
    Yeah, don't use your master keys. Better set up a new IAM role with the minimum permissions the app requires.
    So for example if it needs to read your S3 bucket you don't let it read and write to every bucket in your account. And if need be, you can disable just that key without messing with other apps.