title: Should I hard code IAM credentials for CloudWatch logging within client apps?
body: <p>I have an IAM User that has programmatic access to the CloudWatch Log APIs via access / secret keys. I'm using the following policy to restrict it's access to just a specific <code>LogGroup</code>.</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;VisualEditor0&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: &quot;logs:DescribeLogGroups&quot;,
              &quot;Resource&quot;: &quot;*&quot;
          },
          {
              &quot;Sid&quot;: &quot;VisualEditor1&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: &quot;logs:DescribeLogStreams&quot;,
              &quot;Resource&quot;: &quot;arn:aws:logs:us-west-2:223237870883:log-group:/myappname/dev/client/uwp&quot;
          },
          {
              &quot;Sid&quot;: &quot;VisualEditor2&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;logs:CreateLogStream&quot;,
                  &quot;logs:PutLogEvents&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:logs:us-west-2:223237870883:log-group:/myappname/dev/client/uwp:log-stream:*&quot;,
                  &quot;arn:aws:logs:us-west-2:223237870883:log-group:/myappname/dev/client/uwp&quot;
              ]
          }
      ]
  }
  </code></pre>
  <p>The keys will be shipped with a mobile app into the Android/iOS/Windows/macOS app stores. Each app has it's own key/Policy (the above is for the UWP app) that constrains it to its own CloudWatch <code>LogGroup</code> I create via CloudFormation.</p>
  <p>My question is on the keys themselves. I can either put them in a configuration file or I can hard-code them into the binaries. I was going to hard-code them since I can't change the config files after the fact anyway - if I wanted to change them I'd need to ship a new version of the app regardless. It seemed like hard-coding them in the app make it a bit more difficult for someone to try and steal.</p>
  <p>Worse case if they are stolen is that they flood me with CloudWatch logs. Is there anything I can do to try and prevent that? I tried to looking at Amplify and how it handles this but didn't see anything that stood out there.</p>
  <p>Are there any problems with the approach that I've taken from a security perspective or is this pretty much par for the course?</p>
  <p>As a side-note, I had integrated Visual Studio App Center logging originally but didn't want to deal with building a process to aggregate logs from App Center for clients and CloudWatch for my back-end. App Center seemed to work the same way - access key/client key with nothing that really stopped someone from stealing and logging outside of the app.</p>
  <p>Appreciate any guidance anyone can offer on your experiences with this kind of thing. Not looking for <em>the right answer</em>. Wanting to see what other approaches folks have taken to see if I'm completely off the beaten path or not.</p>