I like the angle of how this reduces the diff between development and production. I also agree that AWS keys as managed at many companies are a security risk. H

I like the angle of how this reduces the diff between development and production. I also agree that AWS keys as managed at many companies are a security risk. However, there's an alternative to Hologram that is built-in to IAM and might provide even more security: multi-factor authentication and the Security Token Service (STS) [0]. MFA requires you to authenticate using both your AWS keys and your MFA device. In other words, an attacker who gains access to your laptop won't gain access to AWS. They'd have to get access to your phone or keyfob too. When writing your IAM policies, you can require that users authenticate with MFA before they can perfom an action. For example, with a policy of { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": "ec2:Describe*", "Resource": "*" }] } a user can list EC2 instances using their keys. If we add this to the statement "Condition": {"Null": {"aws:MultiFactorAuthAge": false}} they cannot. Instead, first they have to use their keys and their MFA device to request temporary keys from Amazon's STS. Then they can use their temporary keys to list instances until those keys expire, after which they have to authenticate again to get new ones. You shouldn't have to modify existing programs to work with STS. Instead, take out any explicit authorization code, just like you would do to use IAM roles. Then, wrap invocations of the programs with a tool that talks to STS and configures your environment. I've written one in ruby [1], and it should be easy to reimplement if you prefer another language. Hopefully Hologram can add support for multi-factor authentication in a future release. Right now, it looks like stealing someone's ssh key is all it would take to get access to AWS. [0] http://docs.aws.amazon.com/IAM/latest/UserGuide/Using_ManagingMFA.html http://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Managi... [1] https://github.com/lonelyplanet/aws-mfa https://github.com/lonelyplanet/aws-mfa