What is the correct way to expose an AWS in an API without giving out your keys?

Question

Sorry about the awkward title.

I am building a Python API. Part of it involves sending and receiving data to an Amazon SQS to communicate with some stuff on an EC2 instance. I don't want to distribute the API with my amazon keys in it though.

What is the correct way around an issue like this? Do I have to write a separate layer that sits in front of SQS with my own authentication or is there a way to add permissions to amazon keys such that uses could just send and receive messages to SQS but couldn't create additional queues or access any other web services?

Answer 1

It depends on your identity requirements. If it's ok for your clients to have AWS accounts, you can give their accounts permission to send messages to your queue. If you want your own identity, then yes, you would need to build a service layer infront of AWS to broker API requests