How to get rid of AWS access keys – Part 2: Reducing Privileges

This blog post outlines practical steps to reduce risk from AWS access keys by enforcing least-privilege IAM policies, removing unnecessary and escalation-prone permissions (e.g., in `iam`/`sts`), limiting resource listing (e.g., `s3:ListAllMyBuckets`), and adding conditional controls (e.g., `aws:SourceIp` or VPC endpoints). It recommends architectural patterns to further mitigate exposure—such as proxying sensitive S3 operations via Lambda/S3 Object Lambda for rate-limiting and redaction, and isolating long-lived S3 pre-signed URL generation into a minimal-privilege microservice—while planning a transition away from access keys where possible.