[allyant]

Not using access keys- although using the cli you could create a user which does have the ability to login to the portal.

[different_sort]

Untrue, any valid access key pair set can call “GetSignInToken” and access the aws console.