What is the best way to store AWS IAM access credentials in a physical/virtual server so services running in it can access it?
This is a problem which was fixed long ago for EC2 instances through instance profiles but I don't know what the best practices are for non-EC2 servers (i.e. a leased box in a datacenter, a RaspberryPi sitting at home, etc).
Note: I'm not talking about a development environment in a personal desktop or laptop here. There are multiple solutions for that scenario.
I would like to avoid, if at all possible, having long-lived access key ID and secret access key pairs sitting around the hard drive in clear text. Many tools and system that require access to AWS services rely on either including access keys and key ID pairs in config files or using the standard environment variables.
One approach I'm considering is using the AWS System Manager's agent (which is already installed in the box) to periodically pull the keys from AWS secret manager or parameter store. The agent itself uses a custom IAM role when running commands and invoking Automation workflows on the host, so I should be able to add extra IAM policies as needed to access parameter store or other AWS services.
Wondering if there are any good practices to achieve this. I do not want to re-invent the wheel if this is a solved problem or come up with an overcooked and complex custom solution.
