AWS Credentials Exposure

# VULNERABLE - Hardcoded AWS credentials
import boto3

# Never do this!
AWS_ACCESS_KEY_ID = "AKIAIOSFODNN7EXAMPLE"
AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
AWS_SESSION_TOKEN = "AQoDYXdzEJr...EXAMPLETOKEN"

s3_client = boto3.client(
    's3',
    aws_access_key_id=AWS_ACCESS_KEY_ID,
    aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
    aws_session_token=AWS_SESSION_TOKEN
)

# Hardcoded RDS password
rds_connection = {
    "host": "mydb.123456789012.us-east-1.rds.amazonaws.com",
    "password": "MyRDSPassword123!",
    "user": "admin",
    "database": "production"
}

# SECURE - Using environment variables and IAM roles
import boto3
import os
import json

# Use IAM roles when running on EC2/ECS/Lambda
# Boto3 automatically finds credentials from the instance metadata
s3_client_iam = boto3.client('s3')

# Or use environment variables for local development
# These are set in the shell, NOT in the code
s3_client_env = boto3.client(
    's3',
    aws_access_key_id=os.environ.get('AWS_ACCESS_KEY_ID'),
    aws_secret_access_key=os.environ.get('AWS_SECRET_ACCESS_KEY')
)

# Use AWS Secrets Manager for RDS passwords
def get_rds_credentials():
    secret_name = "prod/rds/credentials"
    secrets_client = boto3.client('secretsmanager')
    try:
        response = secrets_client.get_secret_value(SecretId=secret_name)
        return json.loads(response['SecretString'])
    except Exception as e:
        print(f"Error retrieving secret: {e}")
        return None

rds_connection = get_rds_credentials()