AWS without Access Keys

Summary

The post describes how Fly Machines can access AWS resources such as an S3 bucket without distributing long-lived AWS access keys. It uses OpenID Connect (OIDC): AWS IAM trusts Fly.io’s OIDC identity provider, a role grants narrowly scoped permissions, and the app receives the role ARN as an environment variable. At boot, Fly’s Rust init requests a machine-specific OIDC token through the /.fly/api Unix socket, writes it to /.fly/oidc_token, and sets AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_SESSION_NAME so the AWS SDK can call STS AssumeRoleWithWebIdentity. AWS verifies the token, issues short-lived credentials, and evaluates the role’s IAM policy before serving the requested object. The trust policy can constrain tokens by audience and subject, including an organization, Fly App, or machine; the same pattern can authenticate against other OIDC-compliant providers, although Azure and GCP lack equivalent init integration.

Takeaways

1. 1

   AWS STS credentials are generated dynamically, expire in minutes, rotate themselves, and fail closed, limiting the blast radius compared with stored AWS keypairs.

2. 2

   The IAM trust policy can restrict access by token audience and subject, including an organization, a specific Fly App, or an individual Fly Machine.

3. 3

   Fly’s OIDC support accepts arbitrary audience strings, allowing authentication to other OIDC-compliant cloud providers, though Azure and GCP do not have equivalent init integration described here.