Wrap your AWS access keys in proxy tokens with IP restrictions, audit logs, and instant revocation — without touching IAM.
See how ShieldKey protects your AWS integration with minimal code changes.
import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
const s3 = new S3Client({
region: "us-east-1",
credentials: {
accessKeyId: "AKIAIOSFODNN7...", // ← shared across team
secretAccessKey: "wJalrXUtnFEMI/..."
}
});
await s3.send(new PutObjectCommand({ ... }));import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
const s3 = new S3Client({
region: "us-east-1",
endpoint: "https://proxy.shieldkey.io",
credentials: {
accessKeyId: "sk_shield_t_8a3f...", // ← revocable proxy token
secretAccessKey: "managed-by-shieldkey"
}
});
await s3.send(new PutObjectCommand({ ... }));Disable any team member's access to your AWS key in one click. No key rotation. No downtime. No re-deploying environment variables.
Set per-token spend caps so a compromised token can't run up your AWS bill. Get alerts before limits are hit.
Restrict each shield token to specific IPs or CIDR ranges. Even if a token leaks, it's useless from unauthorized networks.
See every API call made through your AWS key — who made it, when, from where, and what they accessed.
Your AWS key is encrypted with AES-256-GCM. It's only decrypted in memory during request proxying — never stored in plaintext.
Issue individual shield tokens to each team member. When someone leaves, revoke their token — everyone else keeps working.
Add your AWS key to ShieldKey's encrypted vault. ShieldKey generates a proxy token (starting with sk_shield_t_) that your team uses instead. Your real AKIA key stays encrypted and is never exposed to team members.
Yes. Point your aws-sdk SDK at proxy.shieldkey.io and use a shield token instead of your real API key. The SDK works identically — ShieldKey transparently proxies every request.
Revoke their shield token from the dashboard. Your real AWS key stays active — no rotation, no downtime, no re-deploying secrets across services. Everyone else keeps working without interruption.
ShieldKey's proxy adds less than 25ms at the p50. The proxy decrypts your key in memory, forwards the request, and streams the response back. For most AWS API calls, this overhead is negligible.