mirror of
https://github.com/Infisical/infisical.git
synced 2026-01-09 23:48:05 -05:00
143 lines
7.5 KiB
Plaintext
143 lines
7.5 KiB
Plaintext
---
|
|
title: "AWS IAM User"
|
|
description: "Learn how to automatically rotate Access Key Id and Secret Key of AWS IAM Users."
|
|
---
|
|
|
|
Infisical's AWS IAM User secret rotation capability lets you update the **Access key** and **Secret access key** credentials of a target IAM user from within Infisical
|
|
at a specified interval or on-demand.
|
|
|
|
## Workflow
|
|
|
|
The typical workflow for using the AWS IAM User rotation strategy consists of four steps:
|
|
|
|
1. Creating the target IAM user whose credentials you wish to rotate.
|
|
2. Creating the managing IAM user used by Infisical to rotate the credentials of the target IAM user.
|
|
3. Configuring the rotation strategy in Infisical with the credentials of the managing IAM user.
|
|
4. Pressing the **Rotate** button in the Infisical dashboard to trigger the rotation of the target IAM user's credentials. The strategy can also be configured to rotate the credentials automatically at a specified interval.
|
|
|
|
In the following steps, we explore the end-to-end workflow for setting up this strategy in Infisical.
|
|
|
|
<Steps>
|
|
<Step title="Create the target IAM user">
|
|
To begin, create an IAM user whose credentials you wish to rotate. If you already have an IAM user,
|
|
then you can skip this step.
|
|
</Step>
|
|
<Step title="Create the managing IAM user">
|
|
Next, create another IAM user to be used by Infisical to rotate the credentials of the IAM user in the previous step.
|
|
|
|
2.1. In your AWS console, head to IAM > Access management > Users and press **Create user**.
|
|
|
|
|
|
|
|
2.2. Next, give the user a username like **infisical-rotation-manager** and press **Next**.
|
|
|
|
|
|
|
|
2.3. Next, in the **Set permissions** step, select **Attach policies directly** and then press **Create policy**.
|
|
|
|
|
|
|
|
2.4. Next, in the **Policy editor**, paste the following JSON and press **Next**:
|
|
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "VisualEditor0",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:DeleteAccessKey",
|
|
"iam:GetAccessKeyLastUsed",
|
|
"iam:CreateAccessKey"
|
|
],
|
|
"Resource": "*"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
<Note>
|
|
The IAM policy above uses the wildcard option in Resource: "*".
|
|
|
|
You may want to restrict the policy to a specific path, and make any adjustments as necessary, to control access for the managing user in production.
|
|
|
|
Read more about this [here](https://aws.amazon.com/blogs/security/optimize-aws-administration-with-iam-paths/).
|
|
</Note>
|
|
|
|
In the **Review and create** step, give the policy a name like **infisical-rotation-manager**, press **Create policy** to finish creating the policy.
|
|
|
|
|
|
|
|
2.5. Back in the **Set permissions** step from step 2.3, refresh the policy list and search for the policy you just created from step 2.4.
|
|
|
|
Select the policy and press **Next**.
|
|
|
|
|
|
|
|
In the **Review and create** step, press **Create user** to finish creating the IAM user.
|
|
|
|
|
|
|
|
2.5. Having created the user, head to its Security credentials > Access keys and press **Create access key**.
|
|
|
|
Follow the subsequent steps to create the **access key** and **secret access key** credential pair for the user.
|
|
|
|
|
|
|
|
At the end of the flow, copy the **Access key** and **Secret access key** to use when configuring the AWS IAM User rotation strategy back in Infisical next.
|
|
|
|
|
|
</Step>
|
|
<Step title="Configure the AWS IAM User secret rotation strategy in Infisical">
|
|
3.1. Back in Infisical, head to the Project > Secrets > Environment and path where you want the rotated AWS IAM credentials to appear and create two placeholder secrets.
|
|
|
|
In this example, we'll create two secrets called `AWS_ACCESS_KEY` and `AWS_SECRET_ACCESS_KEY`.
|
|
|
|
|
|
|
|
3.2. Next, in the **Secret Rotation** tab, press on the **AWS IAM** tile to configure the AWS IAM User rotation strategy.
|
|
|
|
|
|
|
|
3.3. Input the configuration details for the AWS IAM User rotation strategy obtained from steps 1 and 2:
|
|
|
|
|
|
|
|
Here's some guidance on each field:
|
|
|
|
- Manager User Access Key: The managing IAM user's access key from step 2.5.
|
|
- Manager User Secret Key: The managing IAM user's secret access key from step 2.5.
|
|
- Manager User AWS Region: The [AWS region](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.RegionsAndAvailabilityZones.html) for Infisical to make requests to such as `us-east-1`.
|
|
- IAM Username: The IAM username of the user from step 1.
|
|
|
|
Next, specify the output secret mappings configuration for the rotated AWS IAM credentials; this is the secrets whose values will be replaced with new credentials after each rotation.
|
|
Here, you can also specify a rotation interval for the credentials to be automatically rotated periodically.
|
|
|
|
In this example, we want to map the output of the rotated AWS IAM credentials to the secrets that we created in step 3.1 (i.e. `AWS_ACCESS_KEY` and `AWS_SECRET_ACCESS_KEY`).
|
|
|
|
|
|
|
|
Finally, press **Submit** to create the secret rotation strategy.
|
|
</Step>
|
|
<Step title="Rotate secrets in Infisical">
|
|
You should now see the AWS IAM User rotation strategy listed in the **Secret Rotation** tab.
|
|
|
|
To manually trigger a rotation, you can press the **Rotate** button on the strategy.
|
|
Once triggered, the secrets in step 3.1 should be updated with new rotated credential values.
|
|
|
|
|
|
</Step>
|
|
</Steps>
|
|
|
|
**FAQ**
|
|
|
|
<AccordionGroup>
|
|
<Accordion title="Why are my AWS IAM credentials not rotating?">
|
|
There are a few reasons for why this might happen:
|
|
|
|
- The strategy configuration is invalid (e.g. the managing IAM user's credentials are incorrect, the target IAM username is incorrect, etc.).
|
|
- The managing IAM user is insufficently permissioned to rotate the credentials of the target IAM user. For instance, you may have setup [paths](https://aws.amazon.com/blogs/security/optimize-aws-administration-with-iam-paths/) for the managing IAM user and the policy does not have the necessary permissions to rotate the credentials.
|
|
- The target IAM user already has 2 access keys configured in AWS; you should delete one of the access keys to allow for rotation.
|
|
</Accordion>
|
|
</AccordionGroup> |