Amazon Web Services credentials may be exposed

Question

Recently Google provided alert to one of my Apps that

Your Amazon Web Services credentials may be exposed. This exposure of your credentials could lead to unauthorized access to your AWS account, which may include associated excessive charges, and potentially unauthorized access to your data and your users' data.

In the application, I'm using Amazon Product Advertising API to get and display the information related to some products.

I'm using SignedRequestsHelper class provided by the Amazon to request the data.

I need to know how can I protect my AWS keys in the Android app.

Thanks.

Answer 1

I need to know how can I protect my AWS keys in the Android app.

As soon the credentials are at the client side, you can consider them compromised. Storing credentials in the app is usually wrong idea.

you provided no other requirements or constraits, so without assuming anything I could only suggest a few ideas

• use credentials with only necessary permissions (e. g. read s3 files, dynamodb records,...)
• implement API (called by the app) and store the aws credentials on the server. Then there's a question how would you reliably authenticate / authorize the mobile app
• use aws cognito to acquire temporary limited aws credentials based on a custom user pool or social login