[GH-ISSUE #2641] Non-aws password file with plaintext aksk has security risks #1260

New issue

Closed

opened 2026-03-04 01:52:36 +03:00 by kerem · 4 comments

kerem commented

2026-03-04 01:52:36 +03:00

Owner

Originally created by @hbao0915 on GitHub (Feb 8, 2025).
Original GitHub issue: https://github.com/s3fs-fuse/s3fs-fuse/issues/2641

Feature request

S3fs requires plaintext Access Key (AK) and Secret Key (SK) without any encryption in the passwd_file option, which may causes security risks such as AKSK leaking. In addition, even if I try to rotate the credential using temporary security credentials, s3fs process needs to be restarted in order to load the new credential(mentioned in #1290 ).

So could you please provide any mechanism to encrypt the plaintext password file?

Originally created by @hbao0915 on GitHub (Feb 8, 2025). Original GitHub issue: https://github.com/s3fs-fuse/s3fs-fuse/issues/2641 ### Feature request S3fs requires plaintext Access Key (AK) and Secret Key (SK) without any encryption in the passwd_file option, which may causes security risks such as AKSK leaking. In addition, even if I try to rotate the credential using temporary security credentials, s3fs process needs to be restarted in order to load the new credential(mentioned in #1290 ). So could you please provide any mechanism to encrypt the plaintext password file?

kerem closed this issue

2026-03-04 01:52:36 +03:00

kerem commented

2026-03-04 01:52:37 +03:00

Author

Owner

@gaul commented on GitHub (Feb 8, 2025):

What does the AWS CLI do? s3fs will follow this.

@gaul commented on GitHub (Feb 8, 2025): What does the AWS CLI do? s3fs will follow this.

kerem commented

2026-03-04 01:52:37 +03:00

Author

Owner

@hbao0915 commented on GitHub (Feb 8, 2025):

So is there any plan to reinforce the non-AWS-CLI method, like encrypting the aksk on the disk and decrypting it while reading.

@hbao0915 commented on GitHub (Feb 8, 2025): So is there any plan to reinforce the non-AWS-CLI method, like encrypting the aksk on the disk and decrypting it while reading.

kerem commented

2026-03-04 01:52:37 +03:00

Author

Owner

@gaul commented on GitHub (Feb 8, 2025):

No.

@gaul commented on GitHub (Feb 8, 2025): No.

kerem commented

2026-03-04 01:52:37 +03:00

Author

Owner

@ggtakec commented on GitHub (Feb 9, 2025):

If it is absolutely necessary, and you have sufficient knowledge, you can create your own DSO(library) and specify it in the credlib option.
Although it is not very helpful, an example of a DSO implementation (I/F, etc.) to specify in credlib can be found at https://github.com/ggtakec/s3fs-fuse-awscred-lib.

@ggtakec commented on GitHub (Feb 9, 2025): If it is absolutely necessary, and you have sufficient knowledge, you can create your own DSO(library) and specify it in the `credlib` option. Although it is not very helpful, an example of a DSO implementation (I/F, etc.) to specify in `credlib` can be found at https://github.com/ggtakec/s3fs-fuse-awscred-lib.