How to provide AWS credentials in an android studio mobile app (kotlin)?

Question

I have a mobile app that I am making in android studio and I want to send a message to an AWS SQS server when the user does something. However, I am running in to problems with giving credentials to the user. Here is my current send message function.

   fun sendMessage(message: String) {
        CoroutineScope(Dispatchers.IO).launch {
            try {

                val accessKey = "[redacted]"
                val secretKey = "[redacted]"

                val credentials = StaticCredentialsProvider {
                    Credentials {
                        accessKeyId = accessKey
                        secretAccessKey = secretKey
                    }
                }

                val sqsClient = SqsClient {
                    region = "us-east-1"
                    credentialsProvider = credentials
                }

                val sendMessageRequest = SendMessageRequest {
                    queueUrl = "[redacted]"
                    messageBody = message
                }

                sqsClient.sendMessage(sendMessageRequest)
            } catch (e: Exception) {
                Log.e("sendMessage", "Failed to send message: ${e.message}", e)
            }
        }
    }

I have also tried using the java sdk but I am running into similar problems. I have allowed internet permissions and added the right dependencies (I think), but I'm not sure why I still get an exception when I try to send something. The exception I get is:

Failed to send message: StaticCredentialsProvider - accessKeyId and secretAccessKey must not be null java.lang.IllegalArgumentException: StaticCredentialsProvider - accessKeyId and secretAccessKey must not be null at aws.sdk.kotlin.runtime.auth.credentials.StaticCredentialsProvider$Builder.build(StaticCredentialsProvider.kt:36) at aws.sdk.kotlin.runtime.auth.credentials.StaticCredentialsProvider$Companion.invoke(StaticCredentialsProvider.kt:26) at com.example.blindbusapp.MainActivity$sendMessage$1.invokeSuspend(MainActivity.kt:103) at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)`

Additionally here is the one gradle dependency I added:

implementation("aws.sdk.kotlin:sqs:0.19.0-beta")

I tried to do it using the Java sdk but I ended up running into many more build related problems.

Answer 1

Mobile apps should not have IAM User credentials because those credentials are persistent and can typically be extracted from the app's binary or in-memory footprint, and thus can be abused.

Read Using Amazon Cognito for mobile apps and learn how to get your mobile app user to authenticate and get, in return, temporary AWS credentials that can be used safely in your mobile app to interact with SQS and other AWS services as needed.