Comment on $5,000 Security BreachComments−jes519912yI have 2-factor auth enabled on my AWS login - but am I right in thinking that if someone has my API keys that they don't need the 2nd factor?−prattbhatt12yYes, someone with your access and secret keys can spin up instances, create buckets, and do everything else that the stolen keys are authorized for.−ceejayoz12yWhich is why most things should be done with IAM keys specifically locked down to minimal privileges.−jes519912yApparently I have access keys that predate the release of IAM ! Fortunately there's a convenient "disable" link on security keys page.−prattbhatt12yAgreed
Comments
I have 2-factor auth enabled on my AWS login - but am I right in thinking that if someone has my API keys that they don't need the 2nd factor?
Yes, someone with your access and secret keys can spin up instances, create buckets, and do everything else that the stolen keys are authorized for.
Which is why most things should be done with IAM keys specifically locked down to minimal privileges.
Apparently I have access keys that predate the release of IAM ! Fortunately there's a convenient "disable" link on security keys page.
Agreed