One by one, profile names scrolled past. They weren’t just strings in a config file. Each was a doorway into an AWS account, with permissions ranging from harmless read‑only to full admin control. The problem wasn’t that they existed. The problem was no one knew exactly who could use them, from where, and for what.
AWS CLI‑style profiles are fast, flexible, and built into the daily muscle memory of cloud teams. But that speed can hide a creeping shadow: static credentials scattered across developer laptops, CI servers, and forgotten scripts. Auditing them isn’t nice to have. It’s the difference between confidence and a breach.
To run a complete access audit, start at the source: the ~/.aws/credentials and ~/.aws/config files. Map every profile to an IAM user or role. Cross‑check against AWS IAM to find orphaned users, over‑permissive policies, and long‑lived access keys. Rotate or deactivate keys older than 90 days.
Next, check where and how these profiles are used. Search code repositories for AWS_PROFILE or embedded access keys. Inspect CI/CD pipelines. Look for environment variables set in containers or virtual machines. Every profile tied to static keys should be an exception, not the rule. Favor short‑lived, session‑based credentials via AWS SSO or STS.
Audit logs in CloudTrail can reveal which profile—mapped to its IAM identity—did what, when, and from where. Filter for risky actions like iam:CreateUser, s3:PutBucketPolicy, or ec2:AuthorizeSecurityGroupIngress. Build habit into the process: run this review monthly and after any major team or infrastructure change.
Good auditing doesn’t just list credentials—it tells you the full story of trust in your AWS environment. When AWS CLI‑style profiles are controlled, transparent, and tied to least‑privilege roles, they stop being a blind spot and become part of a secure workflow.
You don’t need months of engineering cycles to get there. You can see profile mapping, credential rotation tracking, and access auditing live in minutes with hoop.dev. Instant visibility, no code changes, no second guesses.