How to send individual email to each AWS IAM user to inform about their old access key using AWS SNS service?

user_10266733 0
Viewed 778

I have implemented following so far: I used AWS system Manager automation, AWS config and AWS SNS service to get list of all aged access key on my email.This is working fine.

Requirement: I have multiple IAM users in AWS account whose access key are not rotated in last 90 days. Now I want to build some automation in account to send email to each IAM user to inform about their aged access key.

Kindly guide on this.

amazon-iam amazon-sns aws-lambda amazon-web-services
1 Answers

I've created a Lambda to do this, run it daily, and send email to the users.

  1. Get a list of users from IAM
  2. Loop through the list of users
  3. For each access key associated with a user determine its age (today - AccessKey create date)
  4. If it's over 90 days do something (in my case I delete them)

Here's a python snippet from my Lambda:

import json
import boto3
import datetime
from dateutil.tz import tzutc

users = iam.list_users()['Users']
def list_old_keys(warning_sent, keys_disabled):
    for user in users:
        for  access_key in iam.list_access_keys(UserName = user['UserName'])['AccessKeyMetadata']:
            delta = (today - access_key['CreateDate'].replace(tzinfo=None)).days
            if access_key['Status'] == 'Active':
                if delta >= 90: 
                    <Give a Strong Warning to update key>                        
            else:
                if delta >= 90:
                    <Disable the key because it's Inactive and Old>
                    
    return ()

As a side note, depending on your compliance you may want to at least disable the key if it's over 90 days old. I start warning people at 75 days old that their key is going to be deleted and if it's over 90 days old it's deleted.

user_17238570
Related