Question

我试图通过使用Python 3.6和Boto 3的aws lambda函数找出一种方法让用户访问密钥时代。我的问题是，如果有任何存在，我似乎无法找到正确的api调用以此目的。我可以找到的最接近的两个是list_access_keys，我可以用它来查找密钥的创建日期。而get_access_key_last_used可以给我一天上次使用密钥的时间。但是，无论是我还是其他人都找不到像AWS IAM控制台用户视图中所示的访问密钥年龄。是否有办法简单地获得Access密钥年龄？

Answer 1

没有直接的方法。您可以使用以下代码段来实现您的目标：

import boto3, json, time, datetime, sys

client = boto3.client('iam')
username = "<YOUR-USERNAME>"
res = client.list_access_keys(UserName=username)
accesskeydate = res['AccessKeyMetadata'][0]['CreateDate'] ### Use for loop if you are going to run this on production. I just wrote it real quick
accesskeydate = accesskeydate.strftime("%Y-%m-%d %H:%M:%S")
currentdate = time.strftime("%Y-%m-%d %H:%M:%S", time.gmtime())

accesskeyd = time.mktime(datetime.datetime.strptime(accesskeydate, "%Y-%m-%d %H:%M:%S").timetuple())
currentd = time.mktime(datetime.datetime.strptime(currentdate, "%Y-%m-%d %H:%M:%S").timetuple())

active_days = (currentd - accesskeyd)/60/60/24 ### We get the data in seconds. converting it to days
print (int(round(active_days)))

请告诉我这是否符合预期。

Answer 2

这个简单的代码执行相同的工作，而无需花费很多时间，例如：

import boto3
from datetime import date

client = boto3.client('iam')
username = "<YOUR-USERNAME>"
res = client.list_access_keys(UserName=username)
accesskeydate = res['AccessKeyMetadata'][0]['CreateDate'].date()
currentdate = date.today()
active_days = currentdate - accesskeydate
print (active_days.days)

Answer 3

在进一步测试中，我提出了以下在Lambda中运行的代码。如果用户的IAM密钥为90天或更早，则python3.6中的此功能将向用户发送电子邮件。

先决条件

所有IAM用户的电子邮件标签都带有正确的电子邮件地址作为值。

示例；

IAM用户标签键：电子邮件
IAM用户标签值： someone@gmail.com

每封电子邮件都需要在SES中进行确认

    import boto3, os, time, datetime, sys, json
    from datetime import date
    from botocore.exceptions import ClientError

    iam = boto3.client('iam')
    email_list = []
    def lambda_handler(event, context):
        print("All IAM user emails that have AccessKeys 90 days or older")
        for userlist in iam.list_users()['Users']:
                userKeys = iam.list_access_keys(UserName=userlist['UserName'])
                for keyValue in userKeys['AccessKeyMetadata']:
                        if keyValue['Status'] == 'Active':
                                currentdate = date.today()
                                active_days = currentdate - \
                                    keyValue['CreateDate'].date()
                                if active_days >= datetime.timedelta(days=90):
                                    userTags = iam.list_user_tags(
                                        UserName=keyValue['UserName'])
                                    email_tag = list(filter(lambda tag: tag['Key'] == 'email', userTags['Tags']))
                                    if(len(email_tag) == 1):
                                        email = email_tag[0]['Value']
                                        email_list.append(email)
                                        print(email)

        email_unique = list(set(email_list))
        print(email_unique)
        RECIPIENTS = email_unique
        SENDER = "AWS SECURITY "
        AWS_REGION = os.environ['region']
        SUBJECT = "IAM Access Key Rotation"
        BODY_TEXT = ("Your IAM Access Key need to be rotated in AWS Account: 123456789 as it is 3 months or older.\r\n"
                    "Log into AWS and go to your IAM user to fix: https://console.aws.amazon.com/iam/home?#security_credential"
                    )
        BODY_HTML = """
        AWS Security: IAM Access Key Rotation: Your IAM Access Key need to be rotated in AWS Account: 123456789 as it is 3 months or older. Log into AWS and go to your https://console.aws.amazon.com/iam/home?#security_credential to create a new set of keys. Ensure to disable / remove your previous key pair.
                    """            
        CHARSET = "UTF-8"
        client = boto3.client('ses',region_name=AWS_REGION)
        try:
            response = client.send_email(
                Destination={
                    'ToAddresses': RECIPIENTS,
                },
                Message={
                    'Body': {
                        'Html': {
                            'Charset': CHARSET,
                            'Data': BODY_HTML,
                        },
                        'Text': {
                            'Charset': CHARSET,
                            'Data': BODY_TEXT,
                        },
                    },
                    'Subject': {
                        'Charset': CHARSET,
                        'Data': SUBJECT,
                    },
                },
                Source=SENDER,
            )
        except ClientError as e:
            print(e.response['Error']['Message'])
        else:
            print("Email sent! Message ID:"),
            print(response['MessageId'])

Answer 4

使用上述方法，您只会获得访问密钥的年龄。但作为最佳实践或安全方法，您需要检查轮换周期，即上次轮换密钥的时间。如果密钥轮换期限超过 90 天，您可以提醒您的团队。

获取访问密钥轮换年龄的唯一方法是使用 IAM 中的 credentials report。下载，解析，计算年龄。

获取访问密钥时代AWS Boto3

4 个答案: