Evaluate all active AWS IAM access keys and identify any that have not been rotated within the specified maxAccessKeyAge days (default: 90 days); return NON_COMPLIANT if any key exceeds this age threshold. Tabulate the results.

import boto3 # Initialize boto3 client for IAM client = boto3.client( 'iam', aws_access_key_id=getEnvVar('AWS_ACCESS_KEY_ID'), aws_secret_access_key=getEnvVar('AWS_SECRET_ACCESS_KEY') ) # Get all users users = client.list_users()['Users'] # List to store active access keys active_access_keys = [] # Check each user's access keys for user in users: user_name = user['UserName'] access_keys = client.list_access_keys(UserName=user_name)['AccessKeyMetadata'] for access_key in access_keys: if access_key['Status'] == 'Active': active_access_keys.append({ 'UserName': user_name, 'AccessKeyId': access_key['AccessKeyId'], 'CreateDate': access_key['CreateDate'] }) # Print the list of active access keys import json print(json.dumps(active_access_keys, indent=4, default=str))

from datetime import datetime import json # List to store access key rotation dates access_key_rotation_dates = [] # Iterate over each active access key for key in active_access_keys: # Extract the creation date create_date = key['CreateDate'] # Append the rotation date information access_key_rotation_dates.append({ 'UserName': key['UserName'], 'AccessKeyId': key['AccessKeyId'], 'LastRotationDate': create_date }) # Print the access key rotation dates print(json.dumps(access_key_rotation_dates, indent=4, default=str))

from datetime import datetime, timedelta import json # Define maximum key age (e.g., 90 days) maxAccessKeyAge = 90 # Calculate the threshold date threshold_date = datetime.now().astimezone() - timedelta(days=maxAccessKeyAge) # List to store non-compliant keys non_compliant_keys = [] # Iterate through the access keys for key in access_key_rotation_dates: last_rotation_date_str = str(key['LastRotationDate']) # Ensure it's a string try: last_rotation_date = datetime.fromisoformat(last_rotation_date_str) if last_rotation_date < threshold_date: non_compliant_keys.append({ 'UserName': key['UserName'], 'AccessKeyId': key['AccessKeyId'], 'LastRotationDate': key['LastRotationDate'], 'Status': 'NON_COMPLIANT' }) except ValueError: print(f"Skipping invalid date format for user {key['UserName']}: {last_rotation_date_str}") # Print the non-compliant keys print(json.dumps(non_compliant_keys, indent=4, default=str))

import json # Print the non-compliant keys print(json.dumps(non_compliant_keys, indent=4, default=str))

table = context.newtable() table.num_rows = len(non_compliant_keys) + 1 # Including header row table.num_cols = 4 table.title = "IAM Access Key Compliance Check" table.has_header_row = True # Set header row headers = ["UserName", "AccessKeyId", "LastRotationDate", "Status"] for col_index, header in enumerate(headers): table.setval(0, col_index, header) # Populate table with non-compliant keys for row_index, key in enumerate(non_compliant_keys, start=1): table.setval(row_index, 0, key['UserName']) table.setval(row_index, 1, key['AccessKeyId']) table.setval(row_index, 2, key['LastRotationDate']) table.setval(row_index, 3, key['Status']) print("Compliance check results have been tabulated successfully.")