<p>create a service which authorizes against SSO and the provides temporary credentials via AWS STS Service. That way you don't have to store anything anywhere and once the user loses access to SSO they will also lose access to AWS. You need a role with the access to your dev environment and the developers will assume that role. </p>

CC BY-SA 4.0
2019-10-21T20:32:27.790Z
2019-10-21T20:32:27.790Z
petrchpetr
<p>I've created a local development environment for new developers coming to work in the company I work for.</p>

<p>One of the microservices running as part of this local development environment requires access to some AWS s3 bucket.</p>

<p>Up until today, I required each user who used this solution to get AWS access and secret keys by himself but lately the company has implemented Okta SSO solution and now there's a new motivation to use one single dedicated AWS access key through Okta which has read-only access to the required resources in AWS.</p>

<p>I want to avoid hard coding this AWS access key in my code and instead, I want to store the access and secret keys in AWS Secrets Manager and then using an assume role to read the keys from there but the problem is that I have to authenticate somehow against the company's AWS account in order to be able to assume the role and read the keys from AWS SM.</p>

<p>Is there any way to do this?</p>

<amazon-web-services><aws-iam>
Is it possible to read secured keys from aws-secrets-manager without using aws access and secret key?
Itai Ganot
# Is it possible to read secured keys from aws-secrets-manager without using aws access and secret key?

(Asked by: username_0 on 2019-10-20)

I've created a local development environment for new developers coming to work in the company I work for.

One of the microservices running as part of this local development environment requires access to some AWS s3 bucket.

Up until today, I required each user who used this solution to get AWS access and secret keys by himself but lately the company has implemented Okta SSO solution and now there's a new motivation to use one single dedicated AWS access key through Okta which has read-only access to the required resources in AWS.

I want to avoid hard coding this AWS access key in my code and instead, I want to store the access and secret keys in AWS Secrets Manager and then using an assume role to read the keys from there but the problem is that I have to authenticate somehow against the company's AWS account in order to be able to assume the role and read the keys from AWS SM.

Is there any way to do this?

**Tags:** amazon-web-services, aws-iam


---

## 1 answers

### Answer by username_1 on 2019-10-21. Score: 1 | Accepted answer

create a service which authorizes against SSO and the provides temporary credentials via AWS STS Service. That way you don't have to store anything anywhere and once the user loses access to SSO they will also lose access to AWS. You need a role with the access to your dev environment and the developers will assume that role.


---

