How to use AWS CLI to get all access keys only by how old they are

Question

I want to create a script, and perhaps run it in a cron job every 24 hours, which will list all access keys older than 60 days.

I also want to shove the keys older than 60 days into an array so I can iterate over it and perform other options.

I'm looking at Managing access keys for IAM users - AWS Identity and Access Management and it has a aws iam get-access-key-last-used command but that's not what I want. But it's the closet thing I can find.

What I want to get the key where current date - creation date > 60 days.

I'm imagining my script would look something like this:

# some of this is pseudocode just to 
# communicate what I'm envisioning.
# I don't actually know what to put
# here yet; need assistance.

myCommand = "aws cli get key where age > 60"
staleKeys=( $( $myCommand) )

for key in "${staleKeys[@]}"
do
   # log "${key}"
   # run another aws cli command with ${key} as a value
done

Is this possible from the AWS CLI?

When you list access keys, each key in the response includes the CreateDate. You can infer the age. — jarmod

Steven Yong Steven Yong · Accepted Answer · 2021-01-25T07:12:48

I use the following Python boto3 script, not AWS CLI.

Hope this help those who wanna use boto3:

import boto3
from datetime import datetime, timezone

def utc_to_local(utc_dt):
    return utc_dt.replace(tzinfo=timezone.utc).astimezone(tz=None)

def diff_dates(date1, date2):
    return abs(date2 - date1).days

resource = boto3.resource('iam')
client = boto3.client("iam")

KEY = 'LastUsedDate'

for user in resource.users.all():
    Metadata = client.list_access_keys(UserName=user.user_name)
    if Metadata['AccessKeyMetadata']:
        for key in user.access_keys.all():
            
            AccessId = key.access_key_id
            Status = key.status
            CreatedDate = key.create_date

            numOfDays = diff_dates(utc_to_local(datetime.utcnow()), utc_to_local(CreatedDate))
            LastUsed = client.get_access_key_last_used(AccessKeyId=AccessId)

            if (Status == "Active"):
                if KEY in LastUsed['AccessKeyLastUsed']:
                    print("User:", user.user_name,  "Key:", AccessId, "Last Used:", LastUsed['AccessKeyLastUsed'][KEY], "Age of Key:", numOfDays, "Days")
                else:
                    print("User:", user.user_name , "Key:",  AccessId, "Key is Active but NEVER USED")
            else:
                print("User:", user.user_name , "Key:",  AccessId, "Keys is InActive")
    else:
        print("User:", user.user_name , "No KEYS for this USER")

How to use AWS CLI to get all access keys only by how old they are

2 Answers