Your AWS CLI certificate-based authentication replaces static credentials with short-lived, cryptographically signed requests. No plain-text secrets. No leftover tokens in shell history. The certificate proves your identity to AWS with mutual TLS. Once verified, AWS issues temporary access through AWS IAM Roles Anywhere.
To set this up, you first generate an X.509 certificate from a trusted CA. Then you register it as a trust anchor in AWS IAM Roles Anywhere. You create an IAM role with required permissions, and you define policy boundaries that limit what the certificate holder can do. The AWS CLI then signs each request with the private key of that certificate. AWS validates it, checks your role’s trust policy, and grants temporary security credentials.
Unlike access keys, certificates have expiration baked in. AWS CLI certificate-based authentication keeps secrets out of files, avoids hardcoded credentials in scripts, and simplifies revocation. If a certificate is revoked by the CA, access stops instantly. It integrates cleanly with existing identity management and can be paired with automated certificate rotation.