Android应用使用AWS S3存图：凭证暴露问题及正确存储方式咨询

Hey Vijay, let's clear up exactly what's causing the credential exposure warning and how to fix this properly—because storing AWS keys directly in your Android app (in any form) is a critical security mistake.

What's Wrong With Your Current Setup? #

Let's break down the two key issues here:

1. Hardcoding Keys & Committing to Git #

Even if your Git repo is private, committing access/secret keys directly into code history is extremely risky. Git retains every version of your files, so even if you later removed the keys, anyone with access to the repo (now or in the future) can dig through the commit history to extract them. Private repos aren't 100% secure—think about employee turnover, accidental repo sharing, or even breaches that expose private repos.

2. Using BuildConfig to Store Keys #

While this is better than hardcoding directly in your source files, BuildConfig variables get compiled into your APK's bytecode. Anyone with basic reverse-engineering skills can decompile your APK (using tools like Apktool or Jadx) and easily extract these keys. The client-side environment is inherently untrusted—you can't keep secrets safe there.

The Secure Way: Use AWS Cognito Identity Pools #

The only safe approach for mobile apps is to avoid storing long-term AWS credentials on the device entirely. Instead, use AWS Cognito Identity Pools to generate temporary, limited-privilege credentials dynamically. Here's how it works:

• Cognito acts as a broker between your app and AWS services, issuing short-lived credentials (with expiration times) to users—either for anonymous users or authenticated users (via providers like Google, Facebook, or your own backend).
• These temporary credentials have restricted permissions (you define exactly what they can do via IAM roles), so even if they're leaked, the damage is minimal.
• You never store permanent access/secret keys in your app.

Step-by-Step Implementation #

1. Set Up a Cognito Identity Pool

• Go to the AWS Console, navigate to Cognito, and create a new Identity Pool.
• Enable "Unauthenticated identities" if your app allows users to upload files without logging in, or link an identity provider (like Google) for authenticated users.
• Configure the associated IAM roles (one for unauthenticated users, one for authenticated) to grant only the necessary permissions to your S3 bucket. For example, allow s3:PutObject to specific prefixes, but deny s3:DeleteObject or s3:GetObject if you don't need those.

2. Update Your Android Code

Replace your credential initialization code with the AWS Mobile Client, which handles fetching temporary credentials automatically:

// Initialize AWS Mobile Client (best done in your Application class)
AWSMobileClient.getInstance().initialize(this, object : Callback<UserStateDetails> {
    override fun onResult(userStateDetails: UserStateDetails) {
        // Initialization complete—you can now use the S3 client
    }

    override fun onError(e: Exception) {
        Log.e("AWSInit", "Initialization failed", e)
    }
})

// Get the S3 client using temporary credentials from Cognito
val s3Client = AmazonS3Client(
    AWSMobileClient.getInstance().credentialsProvider,
    Region.getRegion(Regions.AP_SOUTH_1)
)

// Proceed with your upload logic as before
AwsUploadFile.Companion.uploadFile(this, s3Client, file, shopName, transferListener)

3. Add Required Dependencies

You already have most of these, but add the Cognito dependency to be safe:

def aws_version = "2.16.+"
implementation "com.amazonaws:aws-android-sdk-s3:$aws_version"
implementation ("com.amazonaws:aws-android-sdk-mobile-client:$aws_version") { transitive = true }
implementation "com.amazonaws:aws-android-sdk-cognito:$aws_version"

4. Configure awsconfiguration.json

Download the awsconfiguration.json file from the AWS Cognito console (it contains your Identity Pool ID and other configs) and place it in app/src/main/res/raw/. Never commit this file to Git—add it to your .gitignore immediately.

Critical Remediation Steps #

• Rotate Your Old Keys: If you ever committed access/secret keys to Git (even if you removed them later), go to the AWS IAM Console, disable those keys, and generate new ones. Old keys in Git history are a ticking time bomb.
• Audit S3 Bucket Access: Check your S3 bucket's access logs for any unusual activity to ensure no unauthorized access has occurred using the exposed keys.
• Clean Up Git History: If you want to fully remove keys from Git history, use tools like git filter-repo to rewrite the history (note: this requires coordination with anyone else using the repo).

内容的提问来源于stack exchange，提问作者Vijay