The Pager Duty alert went off at 2:03 a.m.
Production needed a fix, but access was locked down. Minutes mattered. You grabbed your laptop, fired up the AWS CLI, and realized you didn’t have the keys. That’s how temporary production access becomes the difference between chaos and control.
Permanent credentials are a liability. They linger, they leak, they invite trouble. Temporary AWS CLI production access, on the other hand, gives you just enough permission for just enough time. No more, no less. It’s the principle of least privilege, enforced in real time.
To set it up, you rely on AWS STS. You request short-lived credentials with aws sts assume-role and a trusted role ARN. You set a duration—seconds, minutes, or hours—and you export those keys into your shell. You run the commands you need. You end the session, and the credentials vanish. No rotation, no idle exposure.
The workflow starts in IAM. Create a role for production access with the tightest policy possible. Configure a trusted principal to request it. Then in your CLI:
aws sts assume-role \
--role-arn arn:aws:iam::123456789012:role/ProdAccessRole \
--role-session-name prod-session \
--duration-seconds 3600
Export the returned AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN. Your commands now act with production permissions until the clock runs out. Anyone snooping after that finds nothing.
Auditing improves too. Every temporary session can be logged in CloudTrail with precise timestamps. You know who touched what, when, and for how long. Breach windows shrink from weeks to minutes.
The CLI makes temporary production access fast, but alone it’s not enough. Humans forget to revoke. Roles grow too broad. Approval steps slow you down in emergencies. The fix is to automate the entire request, approval, and expiry flow so there’s no trust gap, no delay, and no shadow access.
That’s where you can take this even further. With Hoop.dev, you skip the manual friction and wire it into your workflow in minutes. Temporary AWS CLI production access becomes instant, auditable, safe. See it live before another 2:03 a.m. hit hits you when you least expect it.