4 ms·
I have 2-factor auth enabled on my AWS login - but am I right in thinking that if someone has my API keys that they don't need the 2nd factor?
by jes5199 13y ago
I have 2-factor auth enabled on my AWS login - but am I right in thinking that if someone has my API keys that they don't need the 2nd factor?
- prattbhatt 13y agoYes, someone with your access and secret keys can spin up instances, create buckets, and do everything else that the stolen keys are authorized for.
- ceejayoz 13y agoWhich is why most things should be done with IAM keys specifically locked down to minimal privileges.
- prattbhatt 13y agoAgreed
- jes5199 13y agoApparently I have access keys that predate the release of IAM ! Fortunately there's a convenient "disable" link on security keys page.