IAMユーザのシークレットアクセスキーをSecret Managerに保管しローテーションさせてみた

IAMAccessKeyRotation
├── requirements.txt
├── template.yaml
└── src
  └── iamuser-secret-access-key-rotation-handler.py

import boto3
import json
import os

secretsmanager_client = boto3.client('secretsmanager')
iam_client = boto3.client('iam')

def handler(event, context):
    # 環境変数からシークレット名を取得
    username = os.environ["IAM_USER_NAME"]

    # イベントからデータを取得
    RotationToken = event['RotationToken']
    secret_arn = event['SecretId']

    # IAMユーザのアクセスキーをローテーションする
    updated_secret = rotate_iamuser_access_key(username)

    # Secrets Managerに新しいアクセスキーを保存
    save_secret_access_key_in_secret_manager(secret_arn,updated_secret,RotationToken)

def rotate_iamuser_access_key(username:str):
    """
    アクセスキーが2個ある場合、1つ削除後、新しく1つ作成する
    """
    # 2個ある場合、古い方のアクセスキーを削除
    # アクセスキーの一覧を取得
    existing_keys = iam_client.list_access_keys(UserName=username)['AccessKeyMetadata']

    # ２個あったら最も古いアクセスキーを削除
    if len(existing_keys) == 2:
        # min()を使い最古値を取得
        older_key = min(existing_keys, key=lambda x: x['CreateDate'])
        iam_client.delete_access_key(
            UserName=username, 
            AccessKeyId=older_key['AccessKeyId']
        )

    # IAMユーザで新しいアクセスキーを作成
    response = iam_client.create_access_key(UserName=username)
    new_access_key_id = response['AccessKey']['AccessKeyId']
    new_secret_access_key = response['AccessKey']['SecretAccessKey']
    print(f'ACCESS KEYを作成しました。')

    # シークレットを更新
    updated_secret = {
        "accessKey": new_access_key_id,
        "secretKey": new_secret_access_key
    }

    return updated_secret

def save_secret_access_key_in_secret_manager(secret_arn:str,updated_secret:dict,RotationToken:str):
    """
    Secrets Managerに新しいアクセスキーを保存
    """
    secretsmanager_client.put_secret_value(
        SecretId=secret_arn,
        SecretString=json.dumps(updated_secret),
        RotationToken=RotationToken
    )

boto3

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: SAM Template for creating an IAM user and setting up Secrets Manager

Parameters:
  IAMUserName:
    Type: String
    Description: "The name of the IAM user whose access keys will be rotated."

Resources:
  IAMUser:
    Type: AWS::IAM::User
    Properties:
      UserName: !Ref IAMUserName
      Policies:
        - PolicyName: S3ListBucketsPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: 
                  - s3:ListAllMyBuckets
                Resource: "*"

  IAMUserSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub "${IAMUserName}-secret"
      Description: "Secret for IAM user access key"
      SecretString: "{}" 

  iamuserSecretAccessKeyRotationHandlerRole:
    Type: AWS::IAM::Role
    Properties: 
      AssumeRolePolicyDocument: 
        Version: '2012-10-17'
        Statement: 
          - Effect: Allow
            Principal: 
              Service: 
                - lambda.amazonaws.com
            Action: 
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: SecretsManagerPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - secretsmanager:DescribeSecret
                  - secretsmanager:GetSecretValue
                  - secretsmanager:PutSecretValue
                  - secretsmanager:UpdateSecretVersionStage
                  - secretsmanager:ListSecretVersionIds
                Resource: !Ref IAMUserSecret
        - PolicyName: IAMAccessKeyPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - iam:CreateAccessKey
                  - iam:DeleteAccessKey
                  - iam:UpdateAccessKey
                  - iam:ListAccessKeys
                Resource: !GetAtt IAMUser.Arn

  iamuserSecretAccessKeyRotationHandler:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: iamuser-secret-access-key-rotation-handler
      Handler: iamuser-secret-access-key-rotation-handler.handler
      Runtime: python3.9
      CodeUri: ./src
      Role: !GetAtt iamuserSecretAccessKeyRotationHandlerRole.Arn
      Environment:
        Variables:
          IAM_USER_NAME: !Ref IAMUserName

  LambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref iamuserSecretAccessKeyRotationHandler
      Action: lambda:InvokeFunction
      Principal: secretsmanager.amazonaws.com
      SourceArn: !Ref IAMUserSecret

  SecretRotationSchedule:
    Type: AWS::SecretsManager::RotationSchedule
    Properties:
      SecretId: !Ref IAMUserSecret
      RotationLambdaARN: !GetAtt iamuserSecretAccessKeyRotationHandler.Arn
      RotationRules:
        AutomaticallyAfterDays: 30

Outputs:
  RotationFunctionArn:
    Description: "ARN of the IAM Access Key Rotation Lambda function"
    Value: !GetAtt iamuserSecretAccessKeyRotationHandler.Arn

sam build

sam deploy \
  --guided
  --capabilities CAPABILITY_NAMED_IAM \
  --profile <YOUR-PROFILE>