如何安全地存储和使用客户的AWS密钥

Question

Is it acceptable to store a customer's secret key & access key id on my server to allow me to access the AWS API on their behalf?

For a password it is simply a matter of using a hash to store an encrypted version but I need to use the actual key value each time I call AWS so I cannot hash it.

In simple terms, for each authenticated user I would store an object a bit like this:

{userdId: [myUserId],
 secretKey: 'jHuiU-jiuhd...',
 accessKeyId: 'abcdef...',
 etc}

I could then access this each time I call AWS.

Now, I could base64 encode it and / or even encrypt it myself, but at some stage I have to decode and decrypt it to make my request and everything I need to do these options will be stored somewhere on the server.

If the data is kept on the server - never sent back to the client - and if the transport from server to AWS is done over SSL, then is this enough?

Answer 1

How to securly store and use a customer's AWS Secret Key

Ansible

If you're using Ansible, consider using Vault to Protect Sensitive Ansible Data . So you can configure it to encrypt the sensitive contents such as private keys.

Keybase

Another way is to use Keybase app which provides end-to-end encrypted data across all your devices.

PGP

Use pgp encryption to encrypt and decrypt sensitive keys.

OpenSSL

Use your public key to encrypt the file , then your private keys to decrypt it.

SSH Vault

Check ssh-vault how it can encrypt/decrypt data using SSH keys.