Wrapping static API keys with IAM roles and beating Shai-Hulud

In view of the recent Shai-Hulud supply chain attack where a malicious package install script exfiltrated the current user’s environment variables and static secrets found in their files, I am describing a solution to eliminate static tokens in favor of dynamic, machine/workload-specific credentials that are time- and scope-limited. Note that this does not aim to prevent malware attacks per se; an…