aws_iam_access_key Resource
Use the aws_iam_access_key
InSpec audit resource to test properties of a single AWS IAM Access Key.
For additional information, including details on parameters and properties, see the AWS documentation on IAM Access Keys.
Install
This resource is available in the Chef InSpec AWS resource pack.
For information on configuring your AWS environment for Chef InSpec and creating an InSpec profile that uses the InSpec AWS resource pack, see the Chef InSpec documentation on the AWS cloud platform.
Syntax
An aws_iam_access_key
resource allows the testing of a single AWS IAM Access Key.
describe aws_iam_access_key(access_key_id: 'AKIA1111111111111111') do
it { should exist }
end
Parameters
This resources requires either an access_key_id
or the IAM username
associated with the Access Key.
access_key_id
(required ifusername
not provided.)The Access Key ID which uniquely identifies the Key. Begins with the characters “AKIA”. This can be passed either as a string or as a
access_key_id: 'value'
key-value entry in a hash.username
(required ifaccess_key_id
not provided.)The IAM Username which is associated with the Access Key. This can be passed either as a string or as a
username: 'value'
key-value entry in a hash.
Properties
access_key_id
- The ID of the Access Key.
username
- The IAM Username which is associated with the Access Key.
status
- The status of the Access Key, e.g. “Active”.
create_date
- The creation date of the Access Key.
Examples
The following examples show how to use this InSpec audit resource.
Test that an IAM Access Key has been used in the last 90 days.
describe aws_iam_access_key(access_key_id: 'AKIA1111111111111111') do
it { should exist }
its('last_used_date') { should be > Time.now - 90 * 86400 }
end
Test that an IAM Access Key for a specific user exists.
describe aws_iam_access_key(username: 'psmith', id: 'AKIA1111111111111111') do
it { should exist }
end
Matchers
For a full list of available matchers, see our Universal Matchers page.This resource has the following special matchers.
exist
The control will pass if the describe returns at least one result.
Use should_not
to test the entity should not exist.
it { should exist }
it { should_not exist }
active
The active
matcher tests if the described IAM Access Key has a status of Active.
it { should be_active }
AWS Permissions
Your Principal will need the IAM:Client:GetAccessKeyLastUsedResponse
action with Effect
set to Allow
.
You can find detailed documentation at Amazon Route 53