Loading...
Loading...
Securely share AWS access keys, secret keys, or IAM credentials with your team.
An AWS access key pair is a 20-character ID beginning with AKIA (or ASIA for short-lived STS tokens) plus a 40-character secret. That pair authenticates every signed SDK request against IAM, EC2, S3, RDS, Lambda, and roughly 200 other services. Whatever the attached IAM policy permits, an attacker holding the pair can do — including jumping into other AWS accounts when a trust relationship is loose enough to allow it.
GitHub, Pastebin, public S3 indexes, and npm postinstall scripts are continuously crawled by AKIA-pattern scanners. Truffle Security and the AWS Trust and Safety team report that an exposed AKIA pair is typically used within four minutes of going public, with sts:GetCallerIdentity probes following in seconds. The classic outcome is a fleet of c5.24xlarge miners across every region before Fraud Detection trips.
PasteOnce fits the moment a static AKIA pair genuinely must move — bootstrapping a CI runner, handing a break-glass credential to an on-call SRE, or seeding a vendor before federation is wired up. Encryption happens in your browser, the recipient reads once, the ciphertext is purged. Pair every transfer with `aws iam update-access-key --status Inactive`, and budget the credential as already leaked.
Client-side encrypted. We can't see your data.
Your data is encrypted in your browser before it leaves your device.
Messages are automatically deleted after being read once.
We never see your data. Only encrypted blobs pass through our servers.
Links work exactly once. Refresh the page and it's gone forever.
Your sensitive data is encrypted in your browser using AES-256-GCM. The encryption key is generated randomly and never sent to our servers.
Only the encrypted blob is stored in our database, with an automatic expiration time. We literally cannot read your data.
When your recipient opens the link, the encrypted data is fetched and immediately deleted from our servers using an atomic Redis GETDEL. The key in the URL hash decrypts the message in their browser.
Issue federated, time-bounded credentials by configuring a role with a trust policy and calling `aws sts assume-role --role-arn ... --duration-seconds 3600`. The resulting ASIA token expires automatically, eliminating the lifecycle problem static AKIAs create.
Add `"Bool": {"aws:MultiFactorAuthPresent": "true"}` and `"NumericLessThan": {"aws:MultiFactorAuthAge": "3600"}` on sensitive actions. An exposed AKIA without the matching MFA device cannot perform iam:*, ec2:RunInstances, or any other guarded operation.
Apply `"IpAddress": {"aws:SourceIp": ["203.0.113.0/24"]}` on the policy. The pasted credential becomes useless from any address outside the office NAT, your VPN concentrator, or the CI provider's documented egress block.
Set a Budgets alarm at $50 of unexpected spend with an SNS topic that pages on-call. A successful compromise is bounded by the gap between exfiltration and the first GPU launch — long enough for the alarm to fire.
Before OIDC federation is wired in, an SRE seeds the runner with a deploy credential. They send the AKIA/secret through PasteOnce to the runner admin, who stores it as a repository secret, runs one workflow, then swaps to a GitHub-OIDC `AssumeRoleWithWebIdentity` configuration.
An Identity Center misconfiguration locks engineering out of the management account at 11pm. The on-call principal pulls the sealed root-account credential from the safe, transmits the secret half via PasteOnce to whoever is repairing the SSO permission set, then rotates once federation returns.
A SaaS observability vendor needs initial credentials before their CloudFormation StackSet provisions a read-only role. The customer mints a scoped IAM user, hands the secret across PasteOnce, the onboarding script runs once, and Terraform deletes the user that same day.
A platform team sunsets 47 long-lived IAM users in favor of Identity Center (formerly AWS SSO). Each developer receives a final short-lived credential via PasteOnce, runs `aws configure sso` once, then the underlying user is hard-deleted.
Only when no federated path exists yet — initial account bootstrap, a vendor's first integration, or break-glass recovery. Outside those cases, hand off an `aws sts assume-role` session token or wire up Identity Center; the static pair is debt the moment you create it.
Run `aws iam update-access-key --access-key-id AKIA... --status Inactive` (effective within seconds across all regions), then `aws iam delete-access-key`. Follow with a CloudTrail lookup on the principal across the last 24 hours and check GuardDuty for `UnauthorizedAccess:IAMUser/*` findings.
Yes — Signature Version 4 needs both halves to sign requests. Some operators split them: AKIA over chat, secret over PasteOnce. That raises the bar for single-channel interception, though it adds friction with no cryptographic guarantee.
An ASIA token plus its session string is safe to relay through PasteOnce because expiration is enforced by AWS itself; an intercepted link past its TTL is already invalid. For roles assumed with `--duration-seconds 900`, the practical exposure window approaches zero.