iOS: Is there a safe way to include an API key in the code?

Question

Amazon has an AWS SDK for iOS, along with several sample apps. In their samples, they put the API credentials in a Constants.h file:

// Constant         


        

Answer 1

You'll probably want to create temporary write credentials using AWS STS tokens instead of passing keys all the way to the client. You can also create OAIs for CloudFront endpoints so no users directly access S3.

http://docs.aws.amazon.com/STS/latest/APIReference/Welcome.html http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html