Cloud Security Maturity Model·AWS v3.0.0

Drag to explore · pinch to zoom
Home / Matrix / Identity and access management / c2.6
Foundational Identity and access management

c2.6 Use temporary credentials instead of access keys

IAM users and long-lived access keys are durable credentials that stay valid until someone rotates them. Prefer IAM roles, which hand out short-lived, automatically expiring credentials, and reserve AWS Secrets Manager for the secrets you genuinely must store.

Implementation guidance

Prefer roles over long-lived keys

IAM users and access keys are long-term credentials: they stay valid until someone rotates them, and a former employee or a leaked key can keep working unnoticed. Use IAM roles instead — they issue temporary, time-bound credentials.

  • Workloads on EC2: attach an instance profile so the application uses role credentials, never embedded keys.
  • Lambda functions: use an execution role.
  • Amazon ECS tasks: use a task role.
  • Human access: federate through IAM Identity Center so people get temporary credentials from your identity provider.

For the secrets you must store, use Secrets Manager

When an application genuinely needs a secret (a database password, a third-party API key), store it in AWS Secrets Manager and retrieve it at runtime rather than hardcoding it. Secrets Manager can rotate supported secrets automatically.

How it fits together

Avoid IAM user + access key long-lived · valid until rotated leaks, gets shared, keeps working after someone leaves Prefer · temporary credentials IAM role → AWS STS short-lived · auto-expiring EC2 · instance profile Lambda · execution role ECS · task role People IAM Identity Center For secrets you must store (DB password, API key), use AWS Secrets Manager.
Instead of long-lived IAM user access keys that stay valid until rotated, IAM roles issue short-lived, auto-expiring credentials — through an instance profile (EC2), execution role (Lambda), task role (ECS), and IAM Identity Center (people). Reserve Secrets Manager for the secrets you genuinely must store.

How to validate

  • What share of your applications use roles (instance profiles, Lambda/ECS execution roles) instead of durable access keys?
  • Are developers trained not to store secrets in code?
  • Are you preventing secrets from being committed to code (scanning, pre-commit checks)?
  • Are you using AWS Secrets Manager to store and rotate secrets such as database passwords?

Threats addressed

  • Access keys shared over email or chat, or left with a former employee, can be used long after they should have been revoked.
  • Keys committed to source control are copied by anyone with read access and are actively scraped by adversaries from public repositories.
  • Hardcoded keys are hard to rotate quickly, which matters most during a known compromise.

AWS services

AWS IAM AWS Secrets Manager AWS IAM Identity Center

Pricing

Free trial · 30 days

AWS Secrets Manager costs USD 0.40 per secret per month plus USD 0.05 per 10,000 API calls, with a 30-day free trial. See Secrets Manager pricing.

Framework mappings

AWS CAF

Well-Architected

NIST CSF

References