Auto Rotation of Secret Key and Access Key in AWS using Lambda

user_13658889 0
Viewed 1246

I want to rotate Access Key and Secret Key automatically using Lambda. (boto3)

Condition is like:

  1. At 85 day of key age user will get a Email for warning
  2. At 90 day Age user will receive a new credential via Email.

  3. At 95th day the old key gets deactivate automatically.(user need to login via fresh Access key and secret key)

    Is this is possible using AWS lambda? Can anyone help me with the code?

aws-lambda boto3 amazon-web-services
2 Answers

Yes. Writing code is use-case specific. You can start writing it yourself and then ask again if you have any specific issue.

But generally, to implement periodic rotation you would use:

The rule would automatically call a target, i.e. your lambda function, which would have logic to perform the rotation. For that boto3's create_access_key_pair along with deleting/disable existing keys (delete_access_key or update_access_key to disable).

user_2488230

Yes this is definitely possible, the AWS SDK has a action for list_access_keys.

If you created a CloudWatch event you could trigger this Lambda every day. Once you call the request you can see all access keys with a UserName value and a CreateDate value.

By doing a comparison between the 2 dates you could then perform the requested action.

user_134609330
Related