Sandbox AWS Access Without Distributing Keys

Grant AWS access safely to many workshop participants and to AI agents without distributing long-lived keys. In this video, you'll learn how to tackle the challenge of provisioning Exasol Personal for 50 to 60 attendees on shared laptops using AWS instance-profile-style temporary credentials via the AWS Container Credentials Full URI and a Lambda function that assumes a role and refreshes credentials automatically. For running secure interactive sessions, you'll see how to utilize a sandbox AWS account, a GitHub repository template with a devcontainer, and a secret shared offline, with the sandbox rotated or removed afterward. This exact architectural pattern also applies to agents running on a remote sandbox, enabling temporary, toggleable AWS access for up to 15 minutes using a Lambda-backed credentials URI, demonstrated with aws sts get-caller-identity. TIMECODES: 00:00 Alexey workshop motivation 03:10 Avoid sharing keys problem 05:20 Instance profiles explained 07:10 Credentials without AWS 10:24 Sandbox and repo setup 12:40 Agent risk from shortcuts 15:06 Safe AWS for agents 19:39 Remote toggle demo and close