How does AWS Secret key and access key work Those keys are too short to be public/private RSA keys. What are they? How does it use them to authenticate the client?

My guess is:


AWS access key ID is a form of unique user/account identifier
AWS secret key is like private key
When AWS CLI sends a API request, the payload is signed by generating an HMAC with the secret key as the key
The HMAC, AccessKeyID and the payload is sent to AWS service
AWS service verifies the identity of the sender and integrity of the message by recomputing the HMAC code.
If it's verified the request is accepted and processed.


Is this accurate? Why does AWS do this instead of asking user to upload a RSA public key? Why is this safer?

EDIT: I think this is how it works -- https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html#ConstructingTheAuthenticationHeader
AWS has designed their own custom authentication algorithm. You are referencing the older signature version (v2), a newer one (v4) was released in 2014. Details are outlined here: Authenticating Requests (AWS Signature Version 4) . A major difference is that the request is not signed with the secret itself, but with a signing key which is generated using the secret. It also uses HMAC-SHA256 for signing.




  Why does AWS do this instead of asking user to upload a RSA public
  key? Why is this safer?


Using asymmetric keys would be safer since AWS would only store a public key instead of the secret, which is stored by both the user and AWS.