Q: How do you design a zero-static-key credential vending system that supplies short-lived, least-privilege cloud credentials (AWS STS / AssumeRoleWithWebIdentity) to developer sandbox environments and temporary CI jobs?

Establish OpenTelemetry / OIDC trust between your Kubernetes clusters (or GitHub Actions/GitLab CI) and AWS IAM. Map Kubernetes ServiceAccounts (IRSA / EKS Pod Identity) or CI repository attributes to dedicated IAM Roles, issuing short-lived STS tokens (15 minutes to 1 hour) scoped to developer namespaces.

aws sts assume-role-with-web-identity \
  --role-arn arn:aws:iam::123456789012:role/DevSandboxRole \
  --role-session-name ephemeral-dev \
  --web-identity-token $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)

Provide developers with an IDP command or Backstage button that invokes AWS IAM Identity Center (SSO) with WebAuthn/FIDO2 MFA, dynamically minting scoped AWS STS credentials directly into developer shell profiles with automatic expiry.

aws sso login --profile sandbox-dev
# Generates ephemeral ~/.aws/cli/cache credentials auto-expiring in 1 hour

Attach AWS IAM Permissions Boundaries and Organization Service Control Policies (SCPs) to sandbox roles, restricting actions to specific regions, disabling costly instance types (e.g., p5 GPU instances unless authorized), and preventing deletion of audit trails.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": ["ec2:RunInstances"],
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {"ForAnyValue:StringLike": {"ec2:InstanceType": ["p5.*", "p4de.*"]}}
    }
  ]
}