← Back to Blog

Managing Dynamic AWS Secrets with HashiCorp Vault

How I built a reliable WhatsApp AI shopping assistant for Clickmothercare that survives hallucinated products, silent save failures, and multi-agent handoff bugs.

Anas Rhimi
Anas Rhimi August 2026 • 8 min read

The Peril of Static AWS Credentials

Hardcoded AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY pairs are a primary vector for cloud breaches. Even when stored securely, long-lived credentials pose a massive risk if leaked. HashiCorp Vault's AWS Secrets Engine solves this by generating dynamic, ephemeral credentials that automatically expire after a predefined Time-To-Live (TTL).

Configuring the AWS Secrets Engine via CLI

Let's walk through configuring Vault to assume a high-privilege IAM role and issue scoped, temporary credentials based on an IAM policy.

#!/bin/bash
# 1. Enable the AWS secrets engine at a specific path
vault secrets enable -path=aws aws

# 2. Configure the root credentials Vault will use to communicate with AWS
# It is highly recommended to use IAM Roles for Service Accounts (IRSA) if Vault is on EKS,
# avoiding the need for static credentials here as well.
vault write aws/config/root \
    access_key=$VAULT_AWS_ACCESS_KEY \
    secret_key=$VAULT_AWS_SECRET_KEY \
    region=us-east-1

# 3. Create a Vault Role that maps to an AWS IAM policy
# This policy grants read-only access to S3.
# We set a strict 1-hour TTL.
vault write aws/roles/s3-readonly \
    credential_type=iam_user \
    policy_document=-<

Once configured, applications don't need AWS credentials. Instead, they authenticate to Vault (e.g., via Kubernetes Service Account token) and request AWS credentials by reading from the role path:

# Requesting dynamic, short-lived credentials
$ vault read aws/creds/s3-readonly

Key                Value
---                -----
lease_id           aws/creds/s3-readonly/f8a...
lease_duration     1h
access_key         AKIA...
secret_key         wJalr...
security_token

Vault dynamically creates an IAM user, attaches the defined policy, and returns the credentials. After 1 hour, Vault automatically deletes the IAM user in AWS, completely eliminating the risk of stale credentials being exploited.

Is your AI agent's infrastructure secure and reliable?

Book a Free 15-Min Technical Audit
Hire Me