Are there any benefits of using AWS STS instead of long-term credentials for app running outside of AWS?

Hi,

The answer by the AI agent details most of the benefits of role credentials vs user credentials.

On your "I still need to create the user that can assume the role, so I will need to keep credentials of that user on the app side anyway", you may want to think about Identity Federation to leverage any identity provider that you like.

IAM Identity Center (https://aws.amazon.com/iam/identity-center/) gives you a very large palette of possible identity providers to solve your issue: see https://docs.aws.amazon.com/singlesignon/latest/userguide/tutorials.html for all of them that you can integrate with standard protocols (OAuth, etc.)

Best,

Didier

You're right to question this, and it's a great opportunity to clarify the benefits of using AWS Security Token Service (STS) over long-term credentials, even for applications running outside of AWS.

While your current setup with a dedicated user, minimal rights, and IP restrictions is a good start, using AWS STS can provide additional security benefits:

1. Limited lifetime: Temporary credentials from STS expire after a short period (15 minutes to 12 hours). If compromised, they have a limited window of use.

2. No need to store long-term credentials: With STS, you can use IAM Roles Anywhere, which allows you to obtain temporary credentials without storing any long-term AWS credentials in your application.

3. Easier credential management: You don't need to rotate or update credentials regularly, as temporary credentials are generated on-demand.

4. Auditing and monitoring: STS requests are logged in CloudTrail, providing better visibility into credential usage and potential security issues.

5. Flexibility: You can adjust permissions by modifying the IAM role without changing application code or credentials.

Your concern about still needing a user to assume the role is valid, but there's a solution. Instead of creating an IAM user, you can use IAM Roles Anywhere. This service allows your on-premises or multi-cloud workloads to obtain temporary credentials using your existing PKI (Public Key Infrastructure) certificates. This eliminates the need to store any AWS credentials in your application.

Here's how it works:

1. Set up a trust anchor in IAM Roles Anywhere using your PKI.
2. Create an IAM role with the necessary permissions for your S3 bucket.
3. Use the IAM Roles Anywhere credential helper in your application to request temporary credentials.

This approach significantly enhances security because:

• No long-term AWS credentials are stored in your application.
• Access is based on your existing PKI, which you likely already manage securely.
• If a certificate is compromised, you can revoke it quickly without changing AWS configurations.

By using IAM Roles Anywhere with STS, you gain the benefits of temporary credentials while eliminating the risk of storing long-term AWS credentials in your application. This addresses your concern about an attacker potentially using compromised credentials to repeatedly assume roles.

In summary, using AWS STS, especially with IAM Roles Anywhere for non-AWS workloads, provides enhanced security, easier management, and better auditing capabilities compared to using long-term credentials, even for applications running outside of AWS.
Sources
Temporary security credentials in IAM - AWS Identity and Access Management
Temporary Access Tokens Through AWS STS - Navigating GDPR Compliance on AWS
AWS security credentials - AWS Identity and Access Management
AWS IAM Roles Anywhere

It's a great question and one that the rePost Agent has answered well, but to summarise a key point, the problem fits into two categories. The first is if you are authenticating a person/user and the second is if you are authenticating a 'machine' (e.g. a script or a device). For the user authentication, yes, you are ultimately relying upon some form of long term credential, either directly in your environment or indirectly via an identity provider. However, the best practise here is to have multi-factor authentication for any user credentials, which provides a much greater level of protection against a compromise of those credentials. For the machine authentication, in order to avoid storing any long term credentials, we have options like IAM Roles Anywhere (described above) which uses a client certificate for authentication instead.