# Automate AWS IAM Key Rotation


**Learn how to Automate AWS IAM Key Rotation**

**Introduction**

We all know how difficult is to manage and rotate AWS IAM keys, there are a lot of tools out there that can help you manage your keys easly but in this blog post I will tell you about the process and introduce you a new tool for key rotation.

Let's first touch base...

**What is IAM**

AWS **Identity and Access Management (IAM)** is a web service that helps you securely control access to AWS resources. You use IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources.


**Key rotation**

Changing access keys (**which consist of an access key ID and a secret access key**) on a regular schedule is a well-known security best practice because it shortens the period an access key is active and therefore reduces the business impact if they are compromised.[(reference)](https://aws.amazon.com/blogs/security/how-to-rotate-access-keys-for-iam-users/)

To manually rotate keys AWS has documented steps needed to follow but this is a bit pain...

``` 
To rotate access keys, you should follow these steps:

Create a second access key in addition to the one in use.
Update all your applications to use the new access key and validate that the applications are working.
Change the state of the previous access key to inactive.
Validate that your applications are still working as expected.
Delete the inactive access key.
```

To get rid of all of this pain let me introduce you to the `aws-iam-key-rotation` tool that will help rotation your keys auto`magically`


![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1652103611461/k-C1PeL42.png align="left")

Let's dig a bit deeper...

**How does it work?**

This script uses AWS CLI to rotate keys, in order to work you should add aws profile name and IAM user as parameter.

***Prerequisites***

- awscli (https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html)
- jq (sudo apt-get install -y jq or brew install jq)

Usage:

`./aws-iam-key-rotation.sh aws-cli-profile iam-user-name`

There are two cases covered by script

1. If user has only one key configured
2. If user has two keys configured

Screenshots:

*If user has only 1 key configured*

It will create new key - check if key works properly, set it up on existing aws cli profile and delete the old one.


![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1652103628441/V8tdiDnQ3.png align="left")


*If user has 2 keys configured*

It will deactivate and delete the oldest key.


![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1652103651855/QZzbk36e2.png align="left")

**Automating the process**

In this example I will be using crontab to schedule script to run every day at 00:00

1. First run `crontab -e`
2. At the beginning of the crontab file add this line `SHELL=/bin/bash`
3. `0 0 * * * /path/to/script/aws-iam-key-rotation.sh <aws-cli-profile> <iam-user-name>`
(if you want to see the logs of each triggered job you can add this `>> /path/to/log/file` at the end of command)
E.g ```0 0 * * * /path/to/script/aws-iam-key-rotation.sh <aws-cli-profile> <iam-user-name> >> /path/to/log/file```
4. Save it and wait for magic to happen :) 


Hope you enjoyed reading this blog post :)

Thank you !