Static access keys compatible with the AWS API
A static access key is required to authenticate a service account in AWS-compatible APIs.
It consists of two parts:
- Key ID
- Secret key
Both parts are used in requests to the AWS-compatible API. A key ID is specified in open format. A secret key is used to sign request parameters and is not specified in the request.
The secret key is stored by the user on their own. Yandex Cloud gives access to it only while the static key is being created.
Static keys do not expire.
Alert
Make sure no third party has access to the secret key. Keep your key in a secure location. If the key becomes known to a third party, reissue it.
In the management console, the page with service account information shows, for each key, the date and time of its most recent use. This information allows you to track down unauthorized use of keys and to delete unused keys without the risk of disrupting Yandex Cloud services.
In addition to static access keys, you can use Security Token Service temporary keys, also compatible with the AWS API, to work with Yandex Object Storage.
Static key format
Key ID
A key ID consists of 25 characters and always starts with YC. Other characters may include:
- Latin letters
- Numbers
- Underscores (
_) and hyphens (-)
Here is an example of a key ID: YCchbYEDdcsYFBnxSWbcjDJDn.
Secret key
A secret consists of 40 characters and always starts with YC. Other characters may include:
- Latin letters
- Numbers
- Underscores (
_) and hyphens (-)
Here is an example of a secret key: YCVdheub7w9bImcGAnd3dZnf08FRbvjeUFvehGvc.
For an example of using a secret key and its ID in an AWS-compliant API, see the AWS Command Line Interface section.
Services that support this authentication method
The following services support authentication based on static access keys: