密码/访问密钥过期时如何通知 IAM 用户？

Question

I am trying to find a solution to notify all AWS IAM Users if their Password and Access Keys expire. Is there a way to do it via console or with some Python script?

The IAM User should get a mail at least before a week when their IAM Password and access keys expire.

Answer 1

Write a script that runs on a regular schedule (you can do this with scheduled Lambda, for example).

Call get_credential_report to see how long till IAM passwords will expire and call list_access_keys to see when access keys were created (and hence calculate when they need to be rotated).

Note: the AWS Management Console warns IAM users when they are within 15 days of password expiration.

Answer 2

For the passwords, you could use the GetCredentialReport API call. In there you will find the password_next_rotation :

When the account has a password policy that requires password rotation, this field contains the date and time, in ISO 8601 date-time format, when the user is required to set a new password. The value for the AWS account (root) is always not_supported.

Using this information, you could write a script to send those emails (assuming you have tagged your users with their email addresses in IAM)

It's available in boto3 : get_credential_report() .

Note that access keys do not expire.

Answer 3

This is my contribution with a simple bash script that can help to achieve that easier

https://gist.github.com/andresjz/048891dc6e92c19bc3346c00513232f3#file-get_accounts_expirations-sh-L5