How to get rid of AWS access keys – Part 3: Replacing the authentication

This report explains secure alternatives to long‑lived AWS IAM user access keys, detailing cross‑cloud OIDC role assumptions, IAM Roles Anywhere, and Systems Manager hybrid activation; it highlights misconfiguration risks (e.g., missing OIDC 'sub' constraints), trade‑offs around certificate and credential storage, and remote management implications, recommending SSM hybrid activation for limited one‑off integrations and Roles Anywhere for larger deployments, while advocating for PKCS#11/TPM support to harden key handling.