Category: Security

Right after writing about replacing my personal AWS keys with IAM Roles Anywhere, I went to fix an unrelated CircleCI failure on this site and ran straight into the CI version of the exact same problem. The pipeline that builds this blog and syncs it to S3 was authenticating with a static AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY pair sitting in a CircleCI context, untouched since 2020. Six years old, permanent by construction, and copied into a third party’s infrastructure where I don’t control the disk, the logs, or who else has access.

That’s a worse spot than a laptop. A key on my machine leaks if my machine leaks. A key in a CI context leaks if CircleCI leaks, if a build script echoes an env var by mistake, if a debugging step dumps the environment, or if anyone with context access ever needs to debug something and pastes more than they meant to. More places it’s copied to, more ways out.

I recently went digging through my ~/.aws/config and found exactly what you’d expect from a file nobody’s looked at in years: two profiles, each with a plaintext aws_access_key_id and aws_secret_access_key sitting right there. One of them turned out to be a root account key. Not an IAM user with scoped permissions — the actual root credential, with the ability to do anything, including closing the account, stored as plaintext on my laptop.

That’s the setup most people have. It works fine for years, right up until a laptop gets stolen, a dotfiles repo gets pushed to the wrong place, or a debugging script accidentally logs the environment.

The fix isn’t a better way to store the secret. It’s not needing one at all.