AWS IAM documentation change
Summary
Added recommended method for using console credentials as temporary credentials, updated documentation links with double slashes, and reordered sections about CloudShell vs CLI login
Security assessment
Promotes using temporary credentials over long-term access keys (security best practice) but does not indicate a specific vulnerability being patched. The change adds guidance about secure credential management.
Diff
diff --git a/IAM/latest/UserGuide/security-creds-programmatic-access.md b/IAM/latest/UserGuide/security-creds-programmatic-access.md index ed8dd76d3..36787f71b 100644 --- a//IAM/latest/UserGuide/security-creds-programmatic-access.md +++ b//IAM/latest/UserGuide/security-creds-programmatic-access.md @@ -22,0 +23,6 @@ Which user needs programmatic access? | To | By +IAM | (Recommended) Use console credentials as temporary credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs. | Following the instructions for the interface that you want to use. + + * For the AWS CLI, see [Login for AWS local development](https://docs.aws.amazon.com//cli/latest/userguide/cli-configure-sign-in.html) in the _AWS Command Line Interface User Guide_. + * For AWS SDKs, see [Login for AWS local development](https://docs.aws.amazon.com//sdkref/latest/guide/access-login.html) in the _AWS SDKs and Tools Reference Guide_. + + @@ -25,2 +31,2 @@ Workforce identity (Users managed in IAM Identity Center) | Use temporary creden - * For the AWS CLI, see [Configuring the AWS CLI to use AWS IAM Identity Center](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html) in the _AWS Command Line Interface User Guide_. - * For AWS SDKs, tools, and AWS APIs, see [IAM Identity Center authentication](https://docs.aws.amazon.com/sdkref/latest/guide/access-sso.html) in the _AWS SDKs and Tools Reference Guide_. + * For the AWS CLI, see [Configuring the AWS CLI to use AWS IAM Identity Center](https://docs.aws.amazon.com//cli/latest/userguide/cli-configure-sso.html) in the _AWS Command Line Interface User Guide_. + * For AWS SDKs, tools, and AWS APIs, see [IAM Identity Center authentication](https://docs.aws.amazon.com//sdkref/latest/guide/access-sso.html) in the _AWS SDKs and Tools Reference Guide_. @@ -32,3 +38,3 @@ IAM | (Not recommended)Use long-term credentials to sign programmatic requests t - * For the AWS CLI, see [Authenticating using IAM user credentials](https://docs.aws.amazon.com/cli/latest/userguide/cli-authentication-user.html) in the _AWS Command Line Interface User Guide_. - * For AWS SDKs and tools, see [Authenticate using long-term credentials](https://docs.aws.amazon.com/sdkref/latest/guide/access-iam-users.html) in the _AWS SDKs and Tools Reference Guide_. - * For AWS APIs, see [Managing access keys for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) in the _IAM User Guide_. + * For the AWS CLI, see [Authenticating using IAM user credentials](https://docs.aws.amazon.com//cli/latest/userguide/cli-authentication-user.html) in the _AWS Command Line Interface User Guide_. + * For AWS SDKs and tools, see [Authenticate using long-term credentials](https://docs.aws.amazon.com//sdkref/latest/guide/access-iam-users.html) in the _AWS SDKs and Tools Reference Guide_. + * For AWS APIs, see [Managing access keys for IAM users](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_credentials_access-keys.html) in the _IAM User Guide_. @@ -51 +57 @@ For many common use cases, there are alternatives to long-term access keys. To i - * **AWS CloudShell** is a browser-based, pre-authenticated shell that you can launch directly from the AWS Management Console. You can run AWS CLI commands against AWS services through your preferred shell (Bash, Powershell, or Z shell). When you do this, you don't need to download or install command line tools. For more information, see [What is AWS CloudShell?](https://docs.aws.amazon.com/cloudshell/latest/userguide/welcome.html) in the _AWS CloudShell User Guide_. + * **Login for AWS local development with console credentials**. You can use the AWS CLI Version 2 and the `aws login` command to generate short-term credentials to run AWS CLI commands using your console credentials. To learn more, see [Login for AWS local development](https://docs.aws.amazon.com//cli/latest/userguide/cli-authentication-user.html) in the _AWS Command Line Interface User Guide_. @@ -53 +59 @@ For many common use cases, there are alternatives to long-term access keys. To i - * **AWS CLI Version 2 integration with AWS IAM Identity Center (IAM Identity Center)**. You can authenticate users and provide short-term credentials to run AWS CLI commands. To learn more, see [Integrating AWS CLI with IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/integrating-aws-cli.html) in the _AWS IAM Identity Center User Guide_ and [Configuring the AWS CLI to use IAM Identity Center](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html) in the _AWS Command Line Interface User Guide_. + * **AWS CloudShell** is a browser-based, pre-authenticated shell that you can launch directly from the AWS Management Console. You can run AWS CLI commands against AWS services through your preferred shell (Bash, Powershell, or Z shell). When you do this, you don't need to download or install command line tools. For more information, see [What is AWS CloudShell?](https://docs.aws.amazon.com/cloudshell/latest/userguide/welcome.html) in the _AWS CloudShell User Guide_.