Security Basics

Before you wire up any AWS SDK integration, there are a handful of defaults worth confirming on day one. None of them take more than a few minutes, and each one closes off a common way integrations go wrong.

This page walks through the minimal checklist: where credentials come from, how tightly the IAM policy is scoped, what never gets logged, and what stays on by default. Every example mirrors between boto3 and the AWS SDK v3.

Prerequisites

• Python: pip install boto3 (boto3 1.43.x, Python 3.10+). TypeScript: npm install @aws-sdk/client-s3 (Node.js 18+).
• An IAM role or user with a policy scoped to the specific service and resource this integration touches.
• No AWS access keys committed to source control, config files, or CI logs.

Basic Examples

1. Let the SDK Resolve Credentials - Never Hardcode Them

Both SDKs use a documented provider chain: environment variables, a shared config/credentials file, then an attached IAM role. Construct the client with no inline credentials and let the chain do the work.

# --- Python (boto3) ---
import boto3
 
# No access key or secret in this call - boto3 resolves them from
# env vars, ~/.aws/credentials, or the role attached to the compute environment.
s3 = boto3.client("s3", region_name="us-east-1")

// --- TypeScript (AWS SDK v3) ---
import { S3Client } from "@aws-sdk/client-s3";
 
// No access key or secret here either - the SDK resolves them from
// env vars, the shared config file, or an attached IAM role.
const s3 = new S3Client({ region: "us-east-1" });

• Never pass aws_access_key_id/accessKeyId and a secret as literal strings in source.
• In production, prefer an IAM role attached to the compute environment (Lambda execution role, ECS task role, EC2 instance profile) over static keys entirely.
• If a key must live somewhere, it belongs in Secrets Manager or Parameter Store, not an env var checked into a repo.

Related: Secrets Handling: Never in Code, Never in Logs - the full pattern for sourcing any credential.

2. Scope the IAM Policy to What This Call Needs

Write the policy for the specific action and resource, not the whole service. A policy that reads and writes one bucket prefix should not grant s3:* on Resource: "*".

# --- Python (boto3) ---
# Policy JSON attached to the role - not SDK code, but the code only
# works within whatever this policy allows.
policy = {
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Action": ["s3:GetObject", "s3:PutObject"],
        "Resource": "arn:aws:s3:::my-bucket/uploads/*",
    }],
}

// --- TypeScript (AWS SDK v3) ---
// Same policy JSON, attached to the role via IaC or the console -
// the SDK call below only works within what this policy allows.
const policy = {
  Version: "2012-10-17",
  Statement: [{
    Effect: "Allow",
    Action: ["s3:GetObject", "s3:PutObject"],
    Resource: "arn:aws:s3:::my-bucket/uploads/*",
  }],
};

• Name the exact actions (s3:GetObject, s3:PutObject), not s3:*.
• Scope Resource to the bucket and prefix the integration actually touches, not the whole bucket or *.
• A policy that "works" is not the same as a policy that is scoped correctly - see Least-Privilege Verification in CI later in this section.

3. Never Log the Raw Request or Response Object

Logging an entire SDK response for debugging is convenient and risky - the object can carry tokens, secrets, or customer data buried in fields you did not expect.

# --- Python (boto3) ---
import boto3
 
secretsmanager = boto3.client("secretsmanager")
resp = secretsmanager.get_secret_value(SecretId="prod/db/password")
 
# Bad: print(resp)  -- logs the SecretString in plaintext
# Good: log only what you need, never the secret payload.
print("secret retrieved", resp["Name"], resp["VersionId"])

// --- TypeScript (AWS SDK v3) ---
import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";
 
const secretsmanager = new SecretsManagerClient({});
const resp = await secretsmanager.send(new GetSecretValueCommand({ SecretId: "prod/db/password" }));
 
// Bad: console.log(resp)  -- logs the SecretString in plaintext
// Good: log only what you need, never the secret payload.
console.log("secret retrieved", resp.Name, resp.VersionId);

• Log specific, reviewed fields (an id, a status, a request id), never the whole object.
• This applies to any call that can return a secret, token, or PII, not just Secrets Manager.
• Structured loggers make this easy to get wrong by default - check what a logging middleware serializes before adding it.

Intermediate Examples

4. Leave TLS Certificate Validation On

Both SDKs verify TLS certificates by default. Never disable verification to route around a local proxy or self-signed certificate issue in production code - fix the trust chain instead.

# --- Python (boto3) ---
import boto3
 
# Default and correct - verify=True is implicit, do not set verify=False.
s3 = boto3.client("s3", region_name="us-east-1")

// --- TypeScript (AWS SDK v3) ---
import { S3Client } from "@aws-sdk/client-s3";
 
// Default and correct - the SDK verifies certificates automatically.
// Do not set an httpsAgent with rejectUnauthorized: false.
const s3 = new S3Client({ region: "us-east-1" });

• If a corporate proxy needs a custom CA, add that CA to the trust store - do not disable verification.
• Certificate bypass flags exist mainly for isolated test tooling, and even then should be temporary.
• This default protects against man-in-the-middle interception of every request the SDK makes.

5. Scan Dependencies Before Adding a New SDK Package

Before pinning a new boto3/botocore version or @aws-sdk/client-* package, run a vulnerability scan so a known CVE does not ship silently.

# --- Python (boto3) ---
# Run before merging a dependency bump:
#   pip install pip-audit
#   pip-audit -r requirements.txt
# pip-audit checks installed packages (including boto3/botocore) against
# the Python Packaging Advisory Database.

// --- TypeScript (AWS SDK v3) ---
// Run before merging a dependency bump:
//   npm audit
// npm audit checks package-lock.json (including @aws-sdk/* packages)
// against the npm security advisory database.

• Run the scan as a CI step, not just locally, so it gates every merge.
• Pair it with Dependabot or Renovate so patched versions arrive as automatic PRs.
• Covered in full, with CI wiring, on the Dependency Scanning page later in this section.

Stack versions: This page was written for boto3 1.43.x (Python 3.10+) and the AWS SDK for JavaScript v3 (Node.js 18+).