/// CONCEPTS / CREDENTIAL SECURITY

Credential Security

For access-key Fleets, your AWS credentials are encrypted at rest using AES-256-GCM and are never stored in plaintext. IAM-Role Fleets store no key material at all — only a role ARN — so there is nothing long-lived to encrypt or leak.

The most secure option is the IAM Role method: storafleet assumes a cross-account role via STS for short-lived credentials, gated by a per-connection ExternalId. The details below apply to the access-keys method.

The encryption key for your credentials is derived from a master secret using HKDF-SHA256 combined with your unique user ID. No two users share a key.

Encryption algorithm

storafleet encrypts your AWS Secret Access Key using AES-256-GCM (Advanced Encryption Standard with a 256-bit key in Galois/Counter Mode). GCM is an authenticated encryption mode — it provides both confidentiality and integrity guarantees. Any tampering with the ciphertext will be detected when the data is decrypted. A unique random 12-byte initialization vector (IV) is generated for each encryption operation, so the same plaintext never produces the same ciphertext.

Key derivation

The 256-bit encryption key is not stored anywhere. Instead, it is derived on-demand using HKDF-SHA256 (HMAC-based Key Derivation Function). The inputs are:

MASTER_ENCRYPTION_KEY — a secret value set in the server environment variables
Your user ID — a unique identifier for your account, used as the HKDF info parameter

Because your user ID is mixed into the key derivation, the resulting key is unique to your account. Even if two users had identical master secrets (which they cannot, since there is only one), their derived keys would differ. Rotating the master key invalidates all stored credentials — users would need to re-enter their AWS credentials after a master key rotation.

What is encrypted

The AWS Secret Access Key is encrypted before being written to the database. The AWS Access Key ID is stored unencrypted — it is not sensitive on its own and is needed for logging and debugging without requiring a full decryption cycle.

The decrypted Secret Access Key exists in server memory only for the duration of an AWS API call. It is never written to logs, never sent to the client, and never transmitted to any third party. The encrypted ciphertext and IV are stored together in the database record for your credential set.

PreviousConnect a Bucket

NextPermissions