User Account Access keys Should Be Rotated

To prevent the issue of user account access keys not being rotated in AWS IAM using the AWS CLI, you can follow these steps:

1. Create a Policy to Enforce Key Rotation: Create an IAM policy that enforces access key rotation by denying actions if the access key is older than a specified number of days.

   aws iam create-policy --policy-name EnforceKeyRotationPolicy --policy-document '{
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Deny",
         "Action": "*",
         "Resource": "*",
         "Condition": {
           "NumericGreaterThan": {
             "aws:MultiFactorAuthAge": "86400"
           }
         }
       }
     ]
   }'
   

2. Attach the Policy to IAM Users or Groups: Attach the created policy to IAM users or groups to enforce the key rotation policy.

   aws iam attach-user-policy --user-name <username> --policy-arn arn:aws:iam::<account-id>:policy/EnforceKeyRotationPolicy
   

   Or for a group:

   aws iam attach-group-policy --group-name <groupname> --policy-arn arn:aws:iam::<account-id>:policy/EnforceKeyRotationPolicy
   

3. Set Up a CloudWatch Rule to Monitor Key Age: Create a CloudWatch rule to monitor the age of access keys and trigger an alert or automated action if they exceed a certain age.

   aws events put-rule --name "AccessKeyAgeMonitor" --schedule-expression "rate(1 day)"
   

4. Create an IAM Role for Automated Key Rotation: Create an IAM role with permissions to rotate access keys and attach it to a Lambda function or an automation script that runs periodically to check and rotate keys.

   aws iam create-role --role-name KeyRotationRole --assume-role-policy-document '{
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "Service": "lambda.amazonaws.com"
         },
         "Action": "sts:AssumeRole"
       }
     ]
   }'
   

   Attach the necessary policy to the role:

   aws iam attach-role-policy --role-name KeyRotationRole --policy-arn arn:aws:iam::aws:policy/IAMFullAccess
   

By following these steps, you can enforce and automate the rotation of IAM user access keys using AWS CLI, thereby preventing the misconfiguration of stale access keys.

To prevent the issue of IAM user account access keys not being rotated in AWS using Python scripts, you can follow these steps:

1. Set Up AWS SDK for Python (Boto3): Ensure you have Boto3 installed and configured with the necessary permissions to manage IAM resources.

   pip install boto3
   

2. Create a Script to Check Access Key Age: Write a Python script to check the age of access keys for all IAM users. If the keys are older than a specified threshold (e.g., 90 days), you can flag them for rotation.

   import boto3
   from datetime import datetime, timedelta
   
   # Initialize a session using Amazon IAM
   iam = boto3.client('iam')
   
   # Define the threshold for key age (e.g., 90 days)
   threshold_days = 90
   threshold_date = datetime.now() - timedelta(days=threshold_days)
   
   # List all IAM users
   users = iam.list_users()
   
   for user in users['Users']:
       username = user['UserName']
       # List access keys for each user
       access_keys = iam.list_access_keys(UserName=username)
       for access_key in access_keys['AccessKeyMetadata']:
           create_date = access_key['CreateDate']
           if create_date < threshold_date:
               print(f"Access key {access_key['AccessKeyId']} for user {username} is older than {threshold_days} days and should be rotated.")
   

3. Automate Key Rotation Notification: Extend the script to send notifications (e.g., via email or SNS) to administrators or the respective IAM users, informing them that their access keys need to be rotated.

   import boto3
   from datetime import datetime, timedelta
   
   # Initialize a session using Amazon IAM and SNS
   iam = boto3.client('iam')
   sns = boto3.client('sns')
   
   # Define the threshold for key age (e.g., 90 days)
   threshold_days = 90
   threshold_date = datetime.now() - timedelta(days=threshold_days)
   
   # Define SNS topic ARN
   sns_topic_arn = 'arn:aws:sns:region:account-id:topic-name'
   
   # List all IAM users
   users = iam.list_users()
   
   for user in users['Users']:
       username = user['UserName']
       # List access keys for each user
       access_keys = iam.list_access_keys(UserName=username)
       for access_key in access_keys['AccessKeyMetadata']:
           create_date = access_key['CreateDate']
           if create_date < threshold_date:
               message = f"Access key {access_key['AccessKeyId']} for user {username} is older than {threshold_days} days and should be rotated."
               print(message)
               # Publish notification to SNS
               sns.publish(
                   TopicArn=sns_topic_arn,
                   Message=message,
                   Subject='IAM Access Key Rotation Notification'
               )
   

4. Schedule the Script to Run Periodically: Use AWS Lambda and CloudWatch Events to schedule the script to run periodically (e.g., daily) to ensure continuous monitoring and notification.

   • Create a Lambda Function:

     • Go to the AWS Lambda console and create a new function.
     • Upload the Python script as the function code.
     • Set up the necessary IAM role with permissions to access IAM and SNS.

   • Create a CloudWatch Event Rule:

     • Go to the CloudWatch console and create a new rule.
     • Set the rule to trigger on a schedule (e.g., daily at midnight).
     • Add the Lambda function as the target for the rule.

By following these steps, you can automate the process of monitoring and notifying about IAM access key rotation, thereby preventing the misconfiguration of stale access keys in your AWS environment.