title: Keeping a secret key secret with Amazon Web Services
body: <p>I'm playing around with using amazon web services in my personal project.  I've grabbed their AWS SDK for .NET and I'm using that, but I'm a little confused.</p>
  
  <ol>
  <li><p>Access to the web service (in this case, SimpleDB, though I don't think that's really material to the question) is authorized via a private/public key pair.</p></li>
  <li><p>The AWS SDK for .NET API used to create a client object requires the private key:</p>
  
  <pre><code>AWSClientFactory.CreateAmazonSimpleDBClient(publicKey, privateKey);
  </code></pre></li>
  <li><p>This is a client application, so the code would be running entirely on the client.</p></li>
  <li><p>Suggesting that the client would need to have access to my private key to have access to the SimpleDB.  But amazon repeatedly and emphatically states that my private key must not leave my control.</p></li>
  </ol>
  
  <p>This doesn't make sense to me, so I figure I must be missing something.  </p>
  
  <p>Is a client-side application the wrong model for the amazon web services in general, for using their AWS SDK for .NET, or am I missing something that makes a client application perfectly reasonable?  Is there a good way to work around this without creating a proxy service of my own that would authenticate clients and forward their requests to the SimpleDB?</p>