User Account Access keys Should Be Rotated

More Info:

The access keys should rotated periodically.

Risk Level

Medium

Address

Security

Compliance Standards

HIPAA, GDPR, CISAWS, CBP, NIST, HITRUST

Triage and Remediation

How to Prevent

Using Console

Using CLI

To prevent the issue of user account access keys not being rotated in AWS IAM using the AWS CLI, you can follow these steps:

Create a Policy to Enforce Key Rotation: Create an IAM policy that enforces access key rotation by denying actions if the access key is older than a specified number of days.

aws iam create-policy --policy-name EnforceKeyRotationPolicy --policy-document '{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "NumericGreaterThan": {
          "aws:MultiFactorAuthAge": "86400"
        }
      }
    }
  ]
}'

Attach the Policy to IAM Users or Groups: Attach the created policy to IAM users or groups to enforce the key rotation policy.

aws iam attach-user-policy --user-name <username> --policy-arn arn:aws:iam::<account-id>:policy/EnforceKeyRotationPolicy

Or for a group:

aws iam attach-group-policy --group-name <groupname> --policy-arn arn:aws:iam::<account-id>:policy/EnforceKeyRotationPolicy

Set Up a CloudWatch Rule to Monitor Key Age: Create a CloudWatch rule to monitor the age of access keys and trigger an alert or automated action if they exceed a certain age.
```
aws events put-rule --name "AccessKeyAgeMonitor" --schedule-expression "rate(1 day)"
```

Create an IAM Role for Automated Key Rotation: Create an IAM role with permissions to rotate access keys and attach it to a Lambda function or an automation script that runs periodically to check and rotate keys.

aws iam create-role --role-name KeyRotationRole --assume-role-policy-document '{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}'

Attach the necessary policy to the role:

aws iam attach-role-policy --role-name KeyRotationRole --policy-arn arn:aws:iam::aws:policy/IAMFullAccess

By following these steps, you can enforce and automate the rotation of IAM user access keys using AWS CLI, thereby preventing the misconfiguration of stale access keys.

Using Python

To prevent the issue of IAM user account access keys not being rotated in AWS using Python scripts, you can follow these steps:

Set Up AWS SDK for Python (Boto3): Ensure you have Boto3 installed and configured with the necessary permissions to manage IAM resources.
```
pip install boto3
```

Create a Script to Check Access Key Age: Write a Python script to check the age of access keys for all IAM users. If the keys are older than a specified threshold (e.g., 90 days), you can flag them for rotation.

import boto3
from datetime import datetime, timedelta

# Initialize a session using Amazon IAM
iam = boto3.client('iam')

# Define the threshold for key age (e.g., 90 days)
threshold_days = 90
threshold_date = datetime.now() - timedelta(days=threshold_days)

# List all IAM users
users = iam.list_users()

for user in users['Users']:
    username = user['UserName']
    # List access keys for each user
    access_keys = iam.list_access_keys(UserName=username)
    for access_key in access_keys['AccessKeyMetadata']:
        create_date = access_key['CreateDate']
        if create_date < threshold_date:
            print(f"Access key {access_key['AccessKeyId']} for user {username} is older than {threshold_days} days and should be rotated.")

Automate Key Rotation Notification: Extend the script to send notifications (e.g., via email or SNS) to administrators or the respective IAM users, informing them that their access keys need to be rotated.

import boto3
from datetime import datetime, timedelta

# Initialize a session using Amazon IAM and SNS
iam = boto3.client('iam')
sns = boto3.client('sns')

# Define the threshold for key age (e.g., 90 days)
threshold_days = 90
threshold_date = datetime.now() - timedelta(days=threshold_days)

# Define SNS topic ARN
sns_topic_arn = 'arn:aws:sns:region:account-id:topic-name'

# List all IAM users
users = iam.list_users()

for user in users['Users']:
    username = user['UserName']
    # List access keys for each user
    access_keys = iam.list_access_keys(UserName=username)
    for access_key in access_keys['AccessKeyMetadata']:
        create_date = access_key['CreateDate']
        if create_date < threshold_date:
            message = f"Access key {access_key['AccessKeyId']} for user {username} is older than {threshold_days} days and should be rotated."
            print(message)
            # Publish notification to SNS
            sns.publish(
                TopicArn=sns_topic_arn,
                Message=message,
                Subject='IAM Access Key Rotation Notification'
            )

Schedule the Script to Run Periodically: Use AWS Lambda and CloudWatch Events to schedule the script to run periodically (e.g., daily) to ensure continuous monitoring and notification.
- Create a Lambda Function:
  - Go to the AWS Lambda console and create a new function.
  - Upload the Python script as the function code.
  - Set up the necessary IAM role with permissions to access IAM and SNS.
- Create a CloudWatch Event Rule:
  - Go to the CloudWatch console and create a new rule.
  - Set the rule to trigger on a schedule (e.g., daily at midnight).
  - Add the Lambda function as the target for the rule.

By following these steps, you can automate the process of monitoring and notifying about IAM access key rotation, thereby preventing the misconfiguration of stale access keys in your AWS environment.

Additional Reading:

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_RotateAccessKey

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

User Account Access keys Should Be Rotated

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

How to Prevent

Additional Reading:

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​How to Prevent

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

How to Prevent

Additional Reading: