AWS Automation Script — Deactivate more than 90 days Unused Access Keys and Users.
Published: 2024-01-05 10:05:09


Script Summary:
This Python script interacts with AWS Identity and Access Management (IAM) to identify and remediate unused access keys within a defined threshold (defaulted to 90 days). 

PECAUTIONS BEFORE EXECUTION:
Review IAM Permissions: Verify that the AWS IAM user or role running this script has appropriate permissions to interact with EC2 instances and modify their metadata options.
Impact on Services: Deactivating access keys can potentially impact services and applications using them. Ensure you have alternative keys or mechanisms in place.

Verify Access Keys: Double-check the IAM Access Keys that you intend to remediate. Providing incorrect IDs could lead to unintended changes.

User Notifications: Notify users or applications affected by access key deactivation to prevent unexpected service disruptions.

Dry Run or Testing: Consider running the script initially in a non-production environment or using a “dry run” mode if available. This helps you understand the script’s behavior without making actual changes.

Review Days Threshold: Review and adjust the DAYS_THRESHOLD variable in the script to reflect the desired threshold for unused access keys.

CODE
The script and requirements are here

LOGIC
The IAM Access Key Remediation script is a Python tool designed to enhance security and compliance in AWS environments. Leveraging the AWS Identity and Access Management (IAM) service, it identifies and manages unused access keys. The script offers three primary functions: listing all unused access keys, listing keys for a specific user, and deactivating access keys that haven’t been used within a defined threshold (defaulted to 90 days). Prior to execution, users are advised to ensure proper IAM permissions, conduct testing in non-production environments, and create backups of critical access keys. This script streamlines access key management, contributing to a more secure AWS ecosystem.

Script Usage
Note: Be cautious when executing the remediate functions, as they will deactivate access keys. This process require special attention while deactivating access keys, which could temporarily affect your AWS IAM Access. Ensure you have a plan for handling potential disruptions before proceeding.

Example 1: Listing all Unused Access Keys
python script_name.py listall

Description: This command triggers the script to list all access keys that haven’t been used in the last 90 days.

Example 2: Deactivate all Unused Access Keys for a single or multiple User
Attention: ‘remediate username’ may block AWS access permission for specified users. Deactivating access keys for user can potentially impact services and applications using them.
python script_name.py remediate username1,username2

Description: Executing this command deactivates all access keys for the specific user username that haven’t been used in the last 90 days. Provide a comma-separated list of user names to remediate multiple users at once.

How to use the script with options
Example 3: List Unused Access Keys for a Specific User
python script_name.py list username

Description: This command instructs the script to list all access keys for the specific user username that haven’t been used in the last 90 days.

Example 4: Deactivate a Specific Access Key for a User
python script_name.py remediate username Access_Key_ID

Description: Running this command deactivates the specific access key access_key_id for the user username if it hasn’t been used in the last 90 days.

DISCLAIMER
Always review and understand the actions that script will perform. Use this script very carefully.

CONCLUSION
The IAM Access Key Remediation script is a Python tool designed to enhance security and compliance in AWS environments. Leveraging the AWS Identity and Access Management (IAM) service, it identifies and manages unused access keys. The script offers three primary functions: listing all unused access keys, listing keys for a specific user, and deactivating access keys that haven’t been used within a defined threshold (default threshold value is 90 days).

Prior to execution, users are advised to ensure proper IAM permissions, conduct testing in non-production environments, and create backups of critical access keys. This script streamlines access key management, contributing to a more secure AWS ecosystem.

For any questions, issues, or additional support, please reach out to Email: vinayak25051991@gmail.com

Thank you for using this script and for your commitment to effective AWS resource management.