An Architect's vision

  X.509 certificates contain a public key and additional metadata (like an expiration date that AWS verifies when you upload the certificate). Each certificate is associated with a private key. When you create a request, you create a digital signature with your private key and then include that signature in the request, along with your certificate. AWS verifies that you're the sender by decrypting the signature with the public key that is in your certificate. AWS also verifies that the certificate you sent matches the certificate that you uploaded to AWS. Use X.509 certificates only when you must sign SOAP-based requests. In all other cases, use access keys.

  Key pairs consist of a public and private key, where you use the private key to create a digital signature, and then AWS uses the corresponding public key to validate the signature. Key pairs are used only for Amazon EC2 and Amazon CloudFront. For Amazon EC2, you use key pairs to access Amazon EC2 instances like when you use SSH to log in to a Linux instance. For more information, see Connecting to Amazon EC2 Instances in the Amazon Elastic Compute Cloud Developer Guide .

Access keys consist of an access key ID (like AKIAIOSFODNN7EXAMPLE) and a secret access key (like wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY). You use access keys to sign programmatic requests that you make to AWS whether you're using the AWS SDK, REST, or Query APIs. The AWS SDKs use your access keys (which you store as part of the application) to sign requests for you so that you don't have to handle the signing process. If you're unable to use the AWS SDK, you can sign requests manually. Access keys are also used with command line interfaces (CLIs). When you use a CLI, the commands that you issue are signed by your access keys, which you can either pass with the command or store as configuration settings on your computer. You can also create and use tem...

AWS Multi-Factor Authentication (AWS MFA) provides an extra level of security that you can apply to your AWS environment. With AWS MFA enabled, when you sign in to an AWS website, you are prompted for your username and password, as well as for an authentication code from an MFA device. Taken together, these multiple factors provide increased security for your AWS account settings and resources. You can enable MFA for the root account and for IAM users.

  If you have multiple individuals or applications that require access to your AWS account, AWS Identity and Access Management (IAM) lets you create unique IAM user identities. Each user can use their own user names and passwords to sign in to the AWS Management Console, AWS Discussion Forums, or AWS Support Center. In some cases, an IAM user name and password are required to use a service, such as sending email with SMTP by using Amazon Simple Email Service.

When you sign up for AWS, you provide an email address and password that is associated with your AWS account. You use these credentials to sign in to secure AWS web pages like the AWS Management Console, AWS Discussion Forums, or AWS Support Center. The account email address and password are root-level credentials, meaning anyone that uses these credentials has full access to all resources in the account. We recommend instead that you can use an IAM user name and password to sign in to AWS web pages.

Following 5 different types of security features are used in AWS Email address and password IAM user name and password Multi-Factor Authentication (MFA) Access keys (access key ID and secret access key) Key pairs