Right after writing about replacing my personal AWS keys with IAM Roles Anywhere, I went to fix an unrelated CircleCI failure on this site and ran straight into the CI version of the exact same problem. The pipeline that builds this blog and syncs it to S3 was authenticating with a static AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY pair sitting in a CircleCI context, untouched since 2020. Six years old, permanent by construction, and copied into a third party’s infrastructure where I don’t control the disk, the logs, or who else has access.

That’s a worse spot than a laptop. A key on my machine leaks if my machine leaks. A key in a CI context leaks if CircleCI leaks, if a build script echoes an env var by mistake, if a debugging step dumps the environment, or if anyone with context access ever needs to debug something and pastes more than they meant to. More places it’s copied to, more ways out.