Security Key store into constant file is secure or suggest any alternate solution? - ios

Question

I am using AWS services to post my images and SNS services for push notification in it.
To post images on the AWS server I have the secret key & access key with me currently I am using that key from the Constant file which is a very simple and easy way to access any defined key.
#define AWS_AccessKey #"###############"
#define AWS_SecretKey #"####################"
But what my question is
is this key secure from others?
is anyone can get easily from Constant file? if YES how ?
Also, I have one more key of my encrypted database of SQLCypher so that key is also stored in my Constant file.
#define DB_KEY #"####################"
What is the best way to store our important keys? and where?
Thanks in advance.

Answer 1

Since the app runs on ec2 a more secure way would be to use an IAM Role attached to the instance. See: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html
That way you wont have to store the AWS keys anywhere. For your SQLCypher key you could use the user data script to pass the key to your ec2 instance at first boot and store it there, so you wont have to store that in the code at least.
Generally such config is best kept in the environment.

Answer 2

As suggested, the best way to use AWS services from EC2 without needing long-term credentials is to assign an IAM Role to the instance (http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html).
If security is critical for you, I suggest to store the SQLCypher key in AWS KMS. KMS can then be accessed by your EC2 instance using its IAM Role.

Answer 3

As I have investigated more in the above secret key store concern I found my solution as mention below.
Reference question to AWS for security key link: https://forums.aws.amazon.com/thread.jspa?threadID=63089
As per the above link, AWS suggests that we need to implement TVM (Token Vending Machine) based service calling to give special rights to user to upload data on S3 or upload data on S3 with a particular bucket.
TVM is a kind of token service that gives user Token valid for 12 hours to 36 hours (max) to communicate with the server.
if Token expires it will again call the service and get a new token from AWS.
The temporary credentials provided by AWS Security Token Service consist of four components:
Access key
ID Secret
access key
Session token
Expiration time
The source for the TVMs is available at GitHub for both the Anonymous TVM and the Identity TVM. By this example, we can get how to get TVM and how to use it to communicate with the server.
Anonymous TVM: https://github.com/amazonwebservices/aws-tvm-anonymous
Identity TVM: https://github.com/amazonwebservices/aws-tvm-identity
Hope this will help others who all struggling with the same security issue for storing secret key.
Full Link for AWS secret key storing: https://aws.amazon.com/articles/Mobile/4611615499399490