#Aws workspaces mac delete key password

The key is simply flipped to deactivated. If an Access Key is past the expiration age it is not deleted and the user is not added to the BlackHole group. It uses GetAccountPasswordPolicy to determine the expiration age for both passwords and keys. The Lambda only does this for IAM Users with LoginProfiles (ie they have a password), so it would not expire a IAM User that only had an access key (that’s a bit more dangerous and requires different handling)1.

#Aws workspaces mac delete key password

The Lambda itself uses the GetCredentialReport to see how long till the password will expire and it queries ListAccessKeys to see when the key was created. (plus all the usual stuff needed to deploy a lambda that’s too big to fit in-line) and an SNS topic where a summary of all actions taken gets published.Header and footer language for the email.Boolean to indicate if we should use SES to email the user.Boolean to indicate if we just warn or actually disable the user or key.

GracePeriodInDays (how far out from expiration do we warn the user).There is the Lambda that does the work (and the appropriate Role and Invocation permissions), an Invocation Failure Alarm that will send to my account’s Alert Topic and a scheduled CloudWatch Event to trigger it to run every day. The cloudformation template creates an IAM Group called UsersWithExpiredCredentials that limits the user to just the IAM actions necessary to change their password. I’ve created a lambda that uses both the AWS Credential Report and the IAM APIs to iterate across all users and send them an SES notification when there password or key is about to expire. Since all our IAM usernames match the user’s email address, this is pretty easy to implement via automation. This would bring my AWS stuff into corporate compliance and prevent me from having to bother my users myself. I wanted something that would implement policy that would deny any usage if the password was past-due (even if they hadn’t logged in for awhile) and would de-activate a key if it was older than the date set in the password policy. However there is no method by which you can notify a user it is about to expire, nor is there anything that would expire an access key that hasn’t been rotated. AWS provides the ability to set a password policy on an account that will require a user to change their password after a certain period of time.