# AWS Credential Types & Resolution Chain

> Covers AWS credential types (keys, IAM roles, env vars) and the resolution chain order used by SDKs and CLI to authenticate requests.

- **URL:** https://hackindex.io/platforms/aws/setup/aws-credential-types-and-resolution-chain
- **Path:** AWS > Setup
- **Up:** [Setup](https://hackindex.io/platforms/aws/setup.md)
- **Published:** 2026-05-24
- **Updated:** 2026-05-24

AWS uses several credential formats. Knowing the type tells you the source, lifetime, and what operations it supports.

## Long-term Access Keys

```
AKIA...
```

Issued to IAM users. No expiry unless manually rotated or deleted. Permissions come from IAM policies attached to that user.

Finding `AKIA` keys in source code, S3 objects, or environment variables is high-value: they persist indefinitely until rotated.

## Temporary Session Credentials

```
ASIA...
```

Three-part credential set: access key ID, secret access key, and session token. Always used together. Generated by STS: for assumed roles, federated identities, EC2 instance profiles, and Lambda execution roles.

Expiry ranges from 15 minutes to 12 hours depending on how they were issued. The session token must accompany every API call.

Export as environment variables:

```bash
export AWS_ACCESS_KEY_ID=ASIA...
export AWS_SECRET_ACCESS_KEY=...
export AWS_SESSION_TOKEN=...
```

Or store in `~/.aws/credentials`:

```ini
[profile-name]
aws_access_key_id = ASIA...
aws_secret_access_key = ...
aws_session_token = ...
```

## Role Credentials

Obtained via `sts:AssumeRole`. Returns temporary credentials scoped to the assumed role's permission set:

```bash
aws sts assume-role --role-arn arn:aws:iam::$ACCOUNT_ID:role/$ROLE_NAME --role-session-name $SESSION_NAME --profile $PROFILE
```

Extract and export the returned values:

```bash
export AWS_ACCESS_KEY_ID=$(aws sts assume-role --role-arn arn:aws:iam::$ACCOUNT_ID:role/$ROLE_NAME --role-session-name $SESSION_NAME --query Credentials.AccessKeyId --output text)
export AWS_SECRET_ACCESS_KEY=$(aws sts assume-role --role-arn arn:aws:iam::$ACCOUNT_ID:role/$ROLE_NAME --role-session-name $SESSION_NAME --query Credentials.SecretAccessKey --output text)
export AWS_SESSION_TOKEN=$(aws sts assume-role --role-arn arn:aws:iam::$ACCOUNT_ID:role/$ROLE_NAME --role-session-name $SESSION_NAME --query Credentials.SessionToken --output text)
```

Role credentials can be chained: assume role A, then from A assume role B. Useful for cross-account lateral movement where no direct trust exists between your current identity and the target role.

## Web Identity Tokens

Used by EKS service accounts, GitHub Actions, and other OIDC-federated workloads. The workload exchanges a signed JWT for temporary STS credentials:

```bash
aws sts assume-role-with-web-identity --role-arn arn:aws:iam::$ACCOUNT_ID:role/$ROLE_NAME --role-session-name $SESSION_NAME --web-identity-token file://$TOKEN_FILE
```

In EKS, the token is mounted at `/var/run/secrets/eks.amazonaws.com/serviceaccount/token`. If a pod's service account is bound to an overpermissioned IAM role, this token is the escalation path.

## Credential Resolution Chain

AWS SDKs and CLI resolve credentials in this order: first match wins:

1. Explicit parameters in code or CLI flags
2. Environment variables (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`)
3. AWS CLI credentials file (`~/.aws/credentials`)
4. AWS CLI config file (`~/.aws/config`)
5. Container credential provider (ECS task role via internal metadata endpoint)
6. EC2 instance profile (IMDS at `169.254.169.254`)

During post-exploitation on EC2 or ECS, instance profile credentials are picked up automatically by any tool using the SDK: the chain reaches step 5 or 6 without manually extracting and exporting keys.

## Identifying Credential Type and Source

Always run this immediately after obtaining credentials:

```bash
aws sts get-caller-identity --profile $PROFILE
# {
#     "UserId": "AIDA...",
#     "Account": "123456789012",
#     "Arn": "arn:aws:iam::123456789012:user/jdoe"
# }
```

The `Arn` field reveals the principal type:

- `arn:aws:iam::...:user/name`: IAM user, long-term keys
- `arn:aws:sts::...:assumed-role/RoleName/Session`: assumed role
- `arn:aws:sts::...:assumed-role/ec2-role/i-abc123`: EC2 instance profile
- `arn:aws:sts::...:assumed-role/RoleName/GitHubActions`: OIDC federation

The account ID in the ARN identifies the target account. A different account ID between your source credentials and the assumed role indicates a cross-account move.