AWS IAM Access Key
This page shows how to write Terraform and CloudFormation for IAM Access Key and write them securely.
aws_iam_access_key (Terraform)
The Access Key in IAM can be configured in Terraform with the resource name aws_iam_access_key. The following sections describe 5 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "aws_iam_access_key" "dev-users-access_key" {
count = length(var.users)
user = join("", ["dev-", var.users[count.index]])
depends_on = [aws_iam_user.dev-users]
}
resource "aws_iam_access_key" "vpc_access_key" {
user = aws_iam_user.vpc.name
}
resource "aws_iam_user_policy" "vpc_user_policy" {
name = "vpc-user-policy"
resource "aws_iam_access_key" "iam_user_s3_full_access" {
count = local.count_iam_user_s3_full_names
user = element(aws_iam_user.iam_user_s3_full_access.*.name, count.index)
pgp_key = base64encode(file(var.pgp_keyname))
}
resource "aws_iam_access_key" "sysadmin-1" {
user = aws_iam_user.sysadmin1.name
}
resource "aws_iam_user" "sysadmin2" {
name = "system_administrator_2"
resource "aws_iam_access_key" "negative1" {
user = "root"
}
resource "aws_iam_access_key" "negative2" {
user = "root"
Parameters
-
create_dateoptional computed - string -
encrypted_secretoptional computed - string -
idoptional computed - string -
key_fingerprintoptional computed - string -
pgp_keyoptional - string -
secretoptional computed - string -
ses_smtp_password_v4optional computed - string -
statusoptional computed - string -
userrequired - string
Explanation in Terraform Registry
Provides an IAM access key. This is a set of credentials that allow API requests to be made as an IAM user.
Tips: Best Practices for The Other AWS IAM Resources
In addition to the aws_iam_account_password_policy, AWS IAM has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
aws_iam_account_password_policy
Ensure AWS IAM account password policies requires long passwords
It's better to enforce the use of long and complex passwords to reduce the risk of bruteforce attacks.
AWS::IAM::AccessKey (CloudFormation)
The AccessKey in IAM can be configured in CloudFormation with the resource name AWS::IAM::AccessKey. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
Type: "AWS::IAM::AccessKey"
Properties:
UserName:
Ref: user0
user1:
Type: "AWS::IAM::AccessKey"
Properties:
UserName:
Ref: user30
user31:
Type: "AWS::IAM::AccessKey"
Properties:
UserName:
Ref: user21
user22:
Type: "AWS::IAM::AccessKey"
Properties:
UserName:
Ref: user0
user1:
Type: "AWS::IAM::AccessKey"
Properties:
UserName:
Ref: user81
user82:
"Type": "AWS::IAM::AccessKey"
},
"userkeyav2686": {
"Properties": {
"UserName": {
"Ref": "polleuxlabncapuseruserav2686"
"Type": "AWS::IAM::AccessKey",
"Properties": {
"Serial": 1,
"Status": "Active",
"UserName": {"Ref": "StagingFluentdSQSPublisher"}
}
"Type" : "AWS::IAM::AccessKey",
"Properties" : {
"UserName" : { "Ref" : "Danny" }
}
} ,
"myaccesskey2" : {
"Type": "AWS::IAM::AccessKey",
"Properties": {
"Status" : "Active",
"UserName" : "ShiftLeftUser"
}
},
"Type": "AWS::IAM::AccessKey",
"Properties": {
"UserName": "Scout2User001"
}
},
"Scout2User001AccessKey002": {
Parameters
Explanation in CloudFormation Registry
Creates a new AWS secret access key and corresponding AWS access key ID for the specified user. The default status for new keys is
Active.If you do not specify a user name, IAM determines the user name implicitly based on the AWS access key ID signing the request. This operation works for access keys under the AWS account. Consequently, you can use this operation to manage AWS account root user credentials. This is true even if the AWS account has no associated users. For information about quotas on the number of keys you can create, see IAM and AWS STS quotas in the IAM User Guide.
Important To ensure the security of your AWS account, the secret access key is accessible only during key and user creation. You must save the key (for example, in a text file) if you want to be able to access it again. If a secret key is lost, you can delete the access keys for the associated user and then create new keys.
Frequently asked questions
What is AWS IAM Access Key?
AWS IAM Access Key is a resource for IAM of Amazon Web Service. Settings can be wrote in Terraform and CloudFormation.
Where can I find the example code for the AWS IAM Access Key?
For Terraform, the jonasv/MFTEST_source-code, knagu/terraform-eks-main and zoitech/terraform-aws-s3-with-iam-access source code examples are useful. See the Terraform Example section for further details.
For CloudFormation, the ServerlessOpsIO/infrastructure, ServerlessOpsIO/infrastructure and ServerlessOpsIO/infrastructure source code examples are useful. See the CloudFormation Example section for further details.
