Access Keys

An S3 access key has two parts:

• an access key that identifies the credential
• a secret key that signs requests and must remain confidential

Create and delete access keys in the Rabata dashboard.

Create a key

1. Open the Rabata dashboard.
2. Select Create Access Key.
3. Enter a name that identifies its application and environment.
4. Copy both credential values when they are displayed.
5. Store them in your deployment secret manager.

The dashboard lists created access keys, but the secret is displayed during creation. If the secret is lost, create a replacement key.

Configure a client

Most S3 clients accept the standard AWS credential variables:

export AWS_ACCESS_KEY_ID=your-rabata-access-key
export AWS_SECRET_ACCESS_KEY=your-rabata-secret-key
export AWS_REGION=us-east-1

Configure the client endpoint separately as:

https://s3.us-east-1.rabata.io

For the AWS CLI, use a named profile:

aws configure --profile rabata

aws s3 ls \
  --profile rabata \
  --endpoint-url https://s3.us-east-1.rabata.io

Rotate a key

Rabata keys are created and deleted; there is no disabled intermediate state in the dashboard. Rotate safely:

1. Create a new, distinctly named key.
2. Deploy it to every application instance and background job.
3. Verify required reads and writes with the new key.
4. Confirm the old key is no longer in use.
5. Delete the old key.

If a key may be exposed, create and deploy its replacement immediately, then delete the exposed key as soon as traffic has moved.

Protect credentials

• Never commit credentials to a repository, image, or client-side application.
• Keep development and production credentials separate.
• Give each independently deployed application its own key so it can be rotated without affecting others.
• Remove keys for retired applications.
• Avoid printing secrets in logs, command history, support messages, or screenshots.

Deleting a key is permanent and any client still using it will fail authentication.

For help with access keys, contact Rabata support.