AWS SSH keys

For security considerations, we strive to prevent IAM users from having both console access and security keys enabled. In practice, this means that each individual requiring console access via the web interface will have a corresponding IAM user without security keys enabled. The Workbench server should be associated with a role that provides S3 access without explicitly storing keys on the instance. For more details, refer to this section. However, if access keys are indispensable for a particular task and no alternatives are available, one should establish a dedicated IAM user for that specific task, ensuring that permissions are judiciously set for this user.

A prime example is GitHub actions. For the build that uploads new package versions to our internal CRAN, access to start and stop EC2 instances is needed; and one of our packages requires S3 access for testing. The sole method to provide this access to GH Actions is by creating access keys and storing them in GitHub secrets.

1. Navigate to the AWS IAM users panel.
2. Select “Create user”.
3. Define the user name and ensure “Provide user access to the AWS Management Console - optional” remains unchecked.
4. Configure permissions. For the github_actions user, as an instance, I attached the “AmazonEC2FullAccess” and “AmazonS3FullAccess” policies.
5. Click “Next” followed by “Create user”.
6. Locate the new user from the user list and access its page.
7. Click on “Security credentials”.
8. Within the “Access keys” section, choose “Create access keys”.
9. In Step 1, under “Access key best practices & alternatives”, opt for “Application running outside AWS”.
10. Step 2 prompts for a description tag for the key pair (optional).
11. During Step 3, the (Access key)-(Secret access key) pair is displayed, with the secret key concealed. Safeguard these keys as necessary, such as in GitHub secrets.

For heightened security, it’s recommended to periodically rotate keys. If you oversee IAM users for platforms like GitHub or CloudResearch, follow these steps:

1. Repeat steps 6-11 from the previous section to generate a new key pair.
2. To remove the old key pair, first “Deactivate” then “Delete” using the “Actions” dropdown button adjacent to the respective key in the IAM/Security credentials section.