Ways to Access AWS

Three interfaces, the same AWS APIs

The Management Console fits interactive work and uses a password with MFA. The AWS CLI fits terminals and scripts. An AWS SDK lets applications call AWS APIs from Python (boto3), JavaScript, Go, Java and other languages. All three send signed HTTPS requests to the same service APIs, so anything you can do in one you can usually do in the others.

flowchart LR
  B["Browser<br/>password + MFA"] --> API["AWS service APIs<br/>signed HTTPS"]
  C["AWS CLI<br/>profile or role"] --> API
  S["SDK code<br/>boto3"] --> API
  API --> IAM["IAM check<br/>allow or deny"]
  IAM --> R["Resources<br/>EC2, S3"]
  %% step B: The Console signs you in with a password and MFA, no access keys.
  %% step C: The CLI signs each request with credentials from a profile, environment variables or a role.
  %% step S: SDKs use the same credential chain inside your application.
  %% step API: Every request reaches the same public service endpoints over HTTPS.
  %% step IAM: IAM evaluates the caller's policies on every single request.
  %% step R: Only allowed requests touch the resources.

Access keys

An access key contains an Access Key ID (like a username, starts with AKIA) and a Secret Access Key (like a password, shown only once). The secret is sensitive: never commit it to Git, embed it in source code, paste it in chat, or create one for the root account. Leaked keys are found by bots on public repositories within minutes and used to run expensive resources.

On AWS compute, prefer IAM roles and temporary credentials over long-lived keys: EC2 instance profiles, Lambda execution roles, ECS task roles. For people, AWS recommends IAM Identity Center with aws configure sso, which gives short-lived credentials after a browser sign-in.

The credential chain

The CLI and SDKs look for credentials in a fixed order and use the first they find:

1. Command-line options such as --profile.
2. Environment variables AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, AWS_PROFILE.
3. The shared files ~/.aws/credentials and ~/.aws/config (including SSO profiles).
4. Container credentials (ECS task role).
5. The EC2 instance profile, served by the instance metadata service.

Because static keys earlier in the chain win, an old aws configure on an EC2 instance can silently override its role. When something behaves unexpectedly, check the identity first.

Other ways in

• AWS CloudShell — a browser shell in the Console, already signed in as you, with the CLI installed. Good for quick tasks without local setup.
• Infrastructure as Code — CloudFormation, Terraform and CDK also call the same APIs.
• AWS Systems Manager Session Manager — opens a shell on an instance through the Console or CLI without SSH keys or open port 22.

The Console does not use access keys for sign-in. The CLI and SDK use the credential chain above.

Traps: creating root access keys; committing ~/.aws/credentials; storing static keys on an instance that already has a role.