AWS IAM Auto Rotation Terraform Module

Terraform module which creates all necessary resources to rotate all aws IAM user access keys in a single aws account. This module is derived from the official AWS documentation for automatically rotating IAM user access keys at scale with AWS Organizations, however, specifically modified to facilitate use cases for single aws accounts. The module can also provide exceptions for cases where the IAM user keys should not be rotated as well as forcing specific user keys rotation.

Prerequisite

1. Email template bucket: The bucket name you provide as s3_bucket_name input needs to exist.
2. Amazon Simple Email Service (Amazon SES) moved out of the sandbox:
   1. First you need to create a verified email identity. To do this,
      1. Open aws management console
      2. Go to SES (simple email service) in aws console
      3. Click on Verified identities on the left tab and then create identity
      4. Select Email address and then write the email address you want to have as verified identity. This email address will be used as from of the email. Note that you need to have access to the email address to verify the identity. Click on Create identity.
      5. Now you need to verify the email address. To do so, open the email you received from aws and click on verification link Once you click the verification link, the email identity will be verified and shown like this:
      6. Now that you have verified one identity, you can request SES service to be out of sandbox environment. Unless, SES is out of sandbox environment, you cannot send email to emails addresses which are not verified.
      7. To request SES service out of Sanbox environment, go to
         1. Account dashboard on the left tab
         2. Click on view Get set up page -> request production access
         3. Fill up the form with relevant details

            1. Mail type:

                transactional
               

            2. Website URL:

                https://www.yourwebsite.com/
               

            3. Use case description:

                IAM auto rotation emails
               

            4. Add additional contact if necessary.

            5. Acknowledge

            6. Click on submit request

         4. Amazon SES service should be out of sandbox environment as soon as it is approved by aws. Once you are out of sandbox environment, you can go ahead and send emails from Amazon SES service.

Usage

terraform {
  required_providers {
    aws = {
      source = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}


module "iam-auto-rotation" {
    source              = "[email protected]:pyradd/iam-auto-rotation.git?ref=v1.0.0" ## for https use "github.com/pyradd/iam-auto-rotation.git?ref=v1.0.0"

    s3_bucket_name      = "<S3-BUCKET-NAME>" 
    admin_email_address = "<ADMIN-EMAIL>"
    recipient_emails    = "<LIST-OF-RECIPIENT-EMAILS>"
    ### for a full list of variables, have a look at variables.tf file ###
}

Requirements

Name	Version
terraform	>= 1.0
aws	>= 5.0

Providers

Name	Version
archive	2.4.0
aws	5.24.0

Modules

No modules.

Resources

Name	Type
aws_cloudwatch_event_rule.rotation_cloud_watch_event_lambda_trigger	resource
aws_cloudwatch_event_target.lambda	resource
aws_iam_group.asaiam_exemptions_group	resource
aws_iam_policy.email_template_access	resource
aws_iam_policy.rotation_function_access	resource
aws_iam_role.notifier_function_execution_role	resource
aws_iam_role.rotation_lambda_function_execution_role	resource
aws_iam_role_policy_attachment.attach_notifier_funtion_policy	resource
aws_iam_role_policy_attachment.attach_rotation_function_policy	resource
aws_iam_role_policy_attachment.managed_policy_1	resource
aws_iam_role_policy_attachment.managed_policy_2	resource
aws_iam_role_policy_attachment.managed_policy_3	resource
aws_iam_role_policy_attachment.managed_policy_4	resource
aws_iam_role_policy_attachment.managed_policy_5	resource
aws_lambda_function.access_key_rotate_lambda_function	resource
aws_lambda_function.notifier_lambda_function	resource
aws_lambda_permission.rotation_cloud_watch_event_lambda_trigger_lambda_permissions	resource
aws_s3_object.object	resource
archive_file.access_key_rotate_lambda_function	data source
archive_file.notifier_lambda_function	data source
aws_caller_identity.current	data source
aws_iam_policy.AWSLambdaBasicExecutionRole	data source
aws_iam_policy.AmazonEC2FullAccess	data source
aws_iam_policy.AmazonSSMFullAccess	data source
aws_iam_policy_document.access_key_rotate_lambda_function_attched_policy	data source
aws_iam_policy_document.notifier_lambda_function_attched_policy	data source
aws_partition.current	data source
aws_region.current	data source

Inputs

Name	Description	Type	Default	Required
admin_email_address	Email address that will be used in the 'sent from' section of the email. This needs to be a validated email identity in simple email service	string	n/a	yes
credential_replication_regions	Please provide the comma separated regions where you want to replicate the credentials (Secret Manager), e.g. us-east-2,us-west-1,us-west-2 Please skip the region where you are creating stack	string	""	no
dry_run_flag	Enables/Disables key rotation functionality. 'True' only sends notifications to end users (Audit Mode). 'False' preforms key rotation and sends notifications to end users (Remediation Mode).	string	"False"	no
email_template_audit	Enter the file name of the email html template to be sent out by the Notifier Module for Audit Mode. Note: Must be located in the 'S3 Bucket Prefix/Template/template_name.html' folder	string	"iam-auto-key-rotation-enforcement.html"	no
email_template_enforce	Enter the file name of the email html template to be sent out by the Notifier Module for Enforce Mode. Note: Must be located in the 'S3 Bucket Prefix/Template/template_name.html' folder	string	"iam-auto-key-rotation-enforcement.html"	no
execution_role_name	Enter the name of IAM Execution Role that will assume the sub-account role for Lambda Execution.	string	"asa-iam-key-rotation-lambda-execution-role"	no
iam_exemption_group	Manage IAM Key Rotation exemptions via an IAM Group. Enter the IAM Group name being used to facilitate IAM accounts excluded from auto-key rotation.	string	"IAMKeyRotationExemptionGroup"	no
iam_role_name	Enter the name of IAM Role that the main ASA-iam-key-auto-rotation-and-notifier-solution.yaml CloudFormation template will assume.	string	"asa-iam-key-rotation-lambda-execution-role"	no
inactive_buffer	The grace period between rotation and deactivation of a key.	string	10	no
inactive_period	The number of days after which to inactivate keys that had been rotated (Note: This must be greater than RotationPeriod).	string	100	no
recipient_emails	List of recipient emails	list(string)	n/a	yes
recovery_grace_period	Recovery grace period between deactivation and deletion.	string	10	no
resource_owner_tag	(Optional) Tag key used to indicate the owner of an IAM user resource.	string	n/a	yes
rotation_period	The number of days after which a key should be rotated (rotating from active to inactive).	string	90	no
s3_bucket_name	S3 Bucket Name where code is located, see the documentation for bucket names https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html	string	n/a	yes
s3_bucket_prefix	The prefix or directory where resources will be stored.	string	"asa-iam-rotation"	no

Outputs

No outputs.