Whether or not AWS is overly complicated, I don’t think this is a good example. Any decent api should have some kind of signatures which work roughly like:

Whether or not AWS is overly complicated, I don’t think this is a good example. Any decent api should have some kind of signatures which work roughly like: signature = hmac_sha256(secret, url+payload+time+etc) set_header(…, auth_header(signature)) And the point is to prove that you know the key without sending it to AWS / your logs, and to prove that the request came from someone with the key ;and not eg someone replaying a message from logs which was either old or modified). Most of the mess seems to be due to AWS wanting to limit the power of the secrets that they store, presumably in case they’re compromised. You can get a reasonably good idea of their architecture by looking at how you construct the derived secret – each inner layer will be more tightly controlled than the one around it.