Question

I am having the following problem. I have an ASP.NET (VB.NET) application that is trying to connect to Amazon Web services using the AWS .NET SDK, and in order to do that the user is entering their Access and secret key. I am then adding the key to configuration like so:

 Dim config As Configuration = WebConfigurationManager.OpenWebConfiguration("~")
 Dim settings As KeyValueConfigurationCollection = config.AppSettings.Settings
 settings("AWSAccessKey").Value = AmazonAccessKeyText.Text
 settings("AWSSecretKey").Value = AmazonSecretKeyText.Text
 config.Save(ConfigurationSaveMode.Modified)
 ConfigurationManager.RefreshSection("appSettings")

While this successfully modifies the web.config file, it still throws an exception at runtime saying that it can’t find the Access key. Can anyone tell me what I am doing wrong?

Answer 1

If I understand correctly you have as ASP.NET application that connects to the AWS on the clients behalf, if so storing the clients credentials locally might be the best idea from a security point of view.

You can either

1. Only store the credentials in memory in the session only when needed in something like a SecureString
2. Store them encrypted on the disk using any crypt apis.

The amazon sdk doesn’t need the credentials stored in the app/web.config. If you look at something like AWSClientFactory.CreateAmazonS3Client , you will notice that you can pass them as parameters to this function