Question

I’m storing all my content in AWS S3 and I would like to know which is the best approach to retrieve my images:

• should I use the account access keys or should I create a user with the correct policies and then use the access keys for that “user”?

Answer 1

Always always always create users with their own IAM policies. You should never use the root account credentials to do anything if you can help it.

It’s like permanently running commands on your local machine as the root user. The account-level access and secret access keys are the absolute keys to the kingdom. With them, a hacker, malicious employee, or well-intentioned-but-prone-to-accidents administrator could completely destroy every AWS resource you have, download anything off them, and in general cause chaos and discord. Even machines with pem files aren’t safe. A root-level user could just cut an AMI off an existing machine.

Take a look at the IAM policy generator. Writing JSON policies is not fun and error prone, but tools like that one will help you get most of the way there.