Long-term AWS access keys remain valid until manually revoked, making them a significant security risk. Unlike temporary credentials, these keys
don’t expire automatically and provide persistent access to your AWS resources. When hardcoded in applications, stored in configuration files, or used
in environments where temporary credentials are available, they create unnecessary security exposure. AWS provides several alternatives like IAM
roles, temporary credentials through AWS STS, and instance profiles that offer better security practices.
What is the potential impact?
If long-term access keys are compromised, attackers gain persistent access to your AWS resources until the keys are manually revoked. This can lead
to unauthorized data access, resource manipulation, unexpected charges, and potential data breaches. The risk is particularly high when keys are
embedded in mobile applications, used on EC2 instances, or stored in version control systems.
