aws_iam_access_key resource

Use the aws_iam_access_key InSpec audit resource to test properties of a single AWS IAM Access Key.

For additional information, including details on parameters and properties, see the AWS documentation on IAM Access Keys.

Syntax

An aws_iam_access_key resource allows the testing of a single AWS IAM Access Key.

describe aws_iam_access_key(access_key_id: 'AKIA1111111111111111') do
  it { should exist }
end

Parameters

This resources requires either an access_key_id or the IAM username associated with the Access Key.

access_key_id (required if username not provided.)

The Access Key ID which uniquely identifies the Key. Begins with the characters “AKIA”. This can be passed either as a string or as a access_key_id: 'value' key-value entry in a hash.

username (required if access_key_id not provided.)

The IAM Username which is associated with the Access Key. This can be passed either as a string or as a username: 'value' key-value entry in a hash.

Properties

access_key_id

The ID of the Access Key.

username

The IAM Username which is associated with the Access Key.

status

The status of the Access Key, e.g. “Active”.

create_date

The creation date of the Access Key.

Examples

The following examples show how to use this InSpec audit resource.

Test that an IAM Access Key has been used in the last 90 days:

describe aws_iam_access_key(access_key_id: 'AKIA1111111111111111') do
  it                    { should exist }
  its('last_used_date') { should be > Time.now - 90 * 86400 }
end

Test that an IAM Access Key for a specific user exists:

describe aws_iam_access_key(username: 'psmith', id: 'AKIA1111111111111111') do
  it { should exist }
end

Matchers

This resource has the following special matchers.

exist

The control will pass if the describe returns at least one result.

Use should_not to test the entity should not exist.

it { should exist }

it { should_not exist }

active

The active matcher tests if the described IAM Access Key has a status of Active.

it { should be_active }

AWS Permissions

Your AWS principal will need the IAM:Client:GetAccessKeyLastUsedResponse action with Effect set to Allow.

You can find detailed documentation at Amazon Route 53