AWS validating Credentials

Question

Say I get a set of access keys from a user, Is there a way to validate them?

For now I'm making simple API calls to methods like, describeVolumes(), describeLoadBalancers() or describeAddresses() and work with Exception codes to validate the Credentials.

But what if I don't know the service? Is there a better way to validate the Credentials?

Answer 1

If you simply wish to validate whether the Credentials are "correct", then your current method is good:

• Make a request to AWS
• Examine the return code
• If the response is InvalidAccessKeyId then the credentials are invalid

This is different to checking whether the user has Permissions to make the API call. Determining whether they have the correct permissions could be done using the IAM Policy Simulator or by attempting a call and checking the response (eg AccessDenied).

Answer 2

Take a look at the AWS IAM API, specifically the GetUser function. From the description:

Retrieves information about the specified user, including the user's creation date, path, unique ID, and ARN.

If you do not specify a user name, IAM determines the user name implicitly based on the AWS access key ID used to sign the request.