Hello!

I'm following the instructions to install this on my Mac (10.14.5), but Homebrew gives me the following error:

wks-000671:~ jplachance$ brew search aws-rotate-iam-keys
==> Formulae
rhyeal/aws-rotate-iam-keys/aws-rotate-iam-keys
wks-000671:~ jplachance$ brew install rhyeal/aws-rotate-iam-keys/aws-rotate-iam-keys
==> Installing aws-rotate-iam-keys from rhyeal/aws-rotate-iam-keys
==> Downloading https://github.com/rhyeal/aws-rotate-iam-keys/archive/v0.9.2.tar.gz
Already downloaded: /Users/jplachance/Library/Caches/Homebrew/downloads/ac8e0f9303ae07d8bec762733bb357796a5236df656317a779653bcaec640429--aws-rotate-iam-keys-0.9.2.tar.gz
Error: An exception occurred within a child process:
  ChecksumMismatchError: SHA256 mismatch
Expected: 997230eb7c75282a951ee4e83310f2830e453a1e121cfe84cfd4733a69b6d3b9
  Actual: 9101bff2a889e5c883fda99b12588dd50bee9d42faf77f6d6e5d94ab35abb9e1
 Archive: /Users/jplachance/Library/Caches/Homebrew/downloads/ac8e0f9303ae07d8bec762733bb357796a5236df656317a779653bcaec640429--aws-rotate-iam-keys-0.9.2.tar.gz
To retry an incomplete download, remove the file above.

How can I get rid of that error without the --force flag? 🙂

Thanks for the help!

Hi @rhyeal,

I also updated the website files to avoid having to build from a template. Installation instructions are now generic and refer back to the readme except for Ubuntu and Homebrew (which do not change based on version number).

Could up sync to S3 when you have time, thanks.

Getting errors when trying to uninstall this package on Ubuntu 20.04 "Focal"

# /etc/lsb-release 
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=20.04
DISTRIB_CODENAME=focal
DISTRIB_DESCRIPTION="Ubuntu 20.04.2 LTS"

username@hostname:~ $ sudo apt remove aws-rotate-iam-keys
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Use 'sudo apt autoremove' to remove them.
The following packages will be REMOVED:
  aws-rotate-iam-keys
0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded.
1 not fully installed or removed.
After this operation, 21.5 kB disk space will be freed.
Do you want to continue? [Y/n] y
(Reading database ... 198016 files and directories currently installed.)
Removing aws-rotate-iam-keys (0.9.8.3) ...
Trying to find a user name for the cron job
ps: root
logname: username
whoami: root
id: root
USER: root
SUDO_USER: username
The user username cannot use this program (crontab)
The user username cannot use this program (crontab)
grep: unrecognized option '--profile'
Usage: grep [OPTION]... PATTERNS [FILE]...
Try 'grep --help' for more information.
The user username cannot use this program (crontab)
dpkg: error processing package aws-rotate-iam-keys (--remove):
 installed aws-rotate-iam-keys package pre-removal script subprocess returned error exit status 1
dpkg: too many errors, stopping
Trying to find a user name for the cron job
ps: root
logname: username
whoami: root
id: root
USER: root
SUDO_USER: username
The user username cannot use this program (crontab)
The user username cannot use this program (crontab)
The user username cannot use this program (crontab)
dpkg: error while cleaning up:
 installed aws-rotate-iam-keys package post-installation script subprocess returned error exit status 1
Errors were encountered while processing:
 aws-rotate-iam-keys
Processing was halted because there were too many errors.
E: Sub-process /usr/bin/dpkg returned an error code (1)

Thank you for the sick work on this project!

I recently updated to MacOS Monterey 12.0.1 (21A559), and since then i'm unable to start the job scheduler.

I tried reinstalling the program (via Homebrew), and re-running brew services start rhyeal/aws-rotate-iam-keys/aws-rotate-iam-keys as per the instructions. This is the error I receive:

Bootstrap failed: 5: Input/output error
Try re-running the command as root for richer errors.
Error: Failure while executing; `/bin/launchctl bootstrap gui/501 /Users/[username]/Library/LaunchAgents/homebrew.mxcl.aws-rotate-iam-keys.plist` exited with 5.

Running the command with sudo as suggested results in:

Warning: Taking root:admin ownership of some aws-rotate-iam-keys paths:
  /bin
  /bin/bash
  /usr/local/opt/aws-rotate-iam-keys
  /usr/local/opt/aws-rotate-iam-keys/bin
  /usr/local/var/homebrew/linked/aws-rotate-iam-keys
This will require manual removal of these paths using `sudo rm` on
brew upgrade/reinstall/uninstall.
Error: Operation not permitted @ apply2files - /bin

Which doesn't give me a clear next step to debug.

For reference, brew doctor currently displays:

Warning: Found Ruby file outside rhyeal/aws-rotate-iam-keys tap formula directory.
(/usr/local/Homebrew/Library/Taps/rhyeal/homebrew-aws-rotate-iam-keys/Formula):
  /usr/local/Homebrew/Library/Taps/rhyeal/homebrew-aws-rotate-iam-keys/aws-rotate-iam-keys.template.rb

Details

` brew tap rhyeal/aws-rotate-iam-keys https://github.com/rhyeal/aws-rotate-iam-keys

==> Tapping rhyeal/aws-rotate-iam-keys
Cloning into '/usr/local/Homebrew/Library/Taps/rhyeal/homebrew-aws-rotate-iam-keys'...
remote: Enumerating objects: 56, done.
remote: Counting objects: 100% (56/56), done.
remote: Compressing objects: 100% (39/39), done.
remote: Total 1035 (delta 22), reused 39 (delta 12), pack-reused 979
Receiving objects: 100% (1035/1035), 564.90 KiB | 3.42 MiB/s, done.
Resolving deltas: 100% (507/507), done.
fatal: Not a valid object name develop
Tapped 1 formula (79 files, 924KB).
➜ Downloads brew upgrade
fatal: Not a valid object name develop`

The latest stable version of the AWS CLI SDK requires user interaction when aws iam delete-access-key is run on line 168

Therefore, when your (awesome!) script is run via crontab or brew services and there is no user interaction as a result, the old key is never deleted. This behavior can be seen by using the AWS CLI SDK directly:

$  aws --version
aws-cli/2.0.58 Python/3.9.0 Darwin/19.6.0 source/x86_64

$  aws iam delete-access-key --access-key-id ACCESS_KEY_ID_HERE
# Prompts for user interaction here, requiring :q to be input

I currently have this installed and working on my mac. It works great. But I also have a windows machine that I occasionally have to work from. If I generate an access key for my windows machine to use, this library stops working on my mac. The rotate keys command fails with the following output:

Rotating keys for profiles: default
Verifying configuration
Verifying credentials
You have more than 1 access key. Ensure you only have 1 access key and try again.

Maybe this can already be done somehow, but I haven't figured out how yet. If there is a way, please share it.

@rhyeal Looks like the SSH key stored on CircleCI is no longer valid, which is preventing builds from completing (they don't even get past checking out the code)...

Using SSH Config Dir '/home/circleci/.ssh'
git version 2.17.1
Cloning git repository
Cloning into '.'...
Warning: Permanently added the ECDSA host key for IP address '140.82.112.4' to the list of known hosts.
[email protected]: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists

My Crontab is :
"* * * * * aws-rotate-iam-keys --profile dev >> ~/Desktop/naver_blog_cron.log 2>&1"

log is /bin/sh: aws-rotate-iam-keys: command not found
Is there anything I'm missing?

thx!

I was having an issue with brew printing the following errors in almost any command. It took me hours to figure out it was related to aws-rotate-iam-keys...

It finally showed up when running in debug mode:

$ brew upgrade --verbose --debug
...
...
/usr/local/Homebrew/Library/Homebrew/brew.rb (Formulary::TapLoader): loading /usr/local/Homebrew/Library/Taps/rhyeal/homebrew-aws-rotate-iam-keys/Formula/aws-rotate-iam-keys.rb
/usr/local/Homebrew/Library/Homebrew/brew.rb (Formulary::FormulaLoader): loading /usr/local/opt/aws-rotate-iam-keys/.brew/aws-rotate-iam-keys.rb
fatal: --local can only be used inside a git repository
fatal: --local can only be used inside a git repository
fatal: not a git repository (or any of the parent directories): .git
...
...

As you can see just loading the formula prints these errors.

Anyone else having the same issue?

Can you please add a export AWS_SESSION_TOKEN="" every time you export new keys in the script?
This will resolve an issue when the script is used with awsume

Thanks!

Hello we're having a problem to install the tool (v0.9.5) since it seems to download a previous version v0.9.2 which fails the checksum verification :
The version is hard-coded and should be rather referenced with a variable:

==> Downloading https://github.com/rhyeal/aws-rotate-iam-keys/archive/v0.9.2.tar.gz
Already downloaded: /Users/anasfettach/Library/Caches/Homebrew/downloads/ac8e0f9303ae07d8bec762733bb3# corporate account
57796a5236df656317a779653bcaec640429--aws-rotate-iam-keys-0.9.2.tar.gz
Error: An exception occurred within a child process:
  ChecksumMismatchError: SHA256 mismatch
Expected: ccbd38ba4c8725438961b0e9a23a5c713b91568e9ebe6f3b687246140b82f89c
  Actual: 9101bff2a889e5c883fda99b12588dd50bee9d42faf77f6d6e5d94ab35abb9e1
 Archive: /Users/anasfettach/Library/Caches/Homebrew/downloads/ac8e0f9303ae07d8bec762733bb357796a5236df656317a779653bcaec640429--aws-rotate-iam-keys-0.9.2.tar.gz
To retry an incomplete download, remove the file above.

Regards

Hello rhyeal,

I'm trying to use this script to rotate my keys automatically. But I'm not find the place where you are giving the number of days it should rotate. And I have multiple keys which I want to rotate based on the days they have created but its not working as expected. And the task scheduler which this is creating that also not working as expected. Could you please check once in the windows machine and try to fix this code. If I fix before that I can also prove the same :)

My computer
sw_vers ProductName: macOS ProductVersion: 11.6 BuildVersion: 20G165

My version of homebrew
brew --version Homebrew 3.2.16 Homebrew/homebrew-core (git revision d1b07a4bbb0; last commit 2021-10-13) Homebrew/homebrew-cask (git revision 467a76e4da; last commit 2021-10-14)

I can run the command aws-rotate-iam-keys --profiles default,{profile} and successfully rotate my keys. I've tried starting the brew service, added --profiles default,{profile} as the only line in my /usr/local/etc/aws-rotate-iam-keys, and then restarted.

Brew is reporting an error with the service and when I check the logs I see:
Rotating keys for profiles: default,{profile} Verifying configuration Could not find keys for profile default. Ensure you have a profile set up using 'aws configure'.

Has anyone seen this before?

Hi @rhyeal,

As the CircleCI config was outdated and no longer running, I've removed it.

Could you remove the checks from the repo when you have time, thanks.

Hi!

aws-rotate-iam-keys is not showing version number when you input --version in MacOS.

I think <%VERSION%> from echo 'version <%VERSION%>' at https://github.com/rhyeal/aws-rotate-iam-keys/blob/master/src/bin/aws-rotate-iam-keys#L60 can't be interpreted.

$ /tmp aws-rotate-iam-keys --version
AWS Rotate IAM Keys (c) 2018+ Adam Link.
Licensed under the GNU General Public License.
Thanks to all the contributors!
version <%VERSION%>
$ /tmp sw_vers
ProductName:	macOS
ProductVersion:	12.0.1
BuildVersion:	21A559

Some debug information with bash -x aws-rotate-iam-keys --version:

+ test -t 1
+ set -eu -o errexit -o pipefail -o noclobber -o nounset
+ IFS='
	'
+ getopt --test
+ [[ 0 -ne 4 ]]
+ which brew
++ brew --prefix
+ test -d /usr/local/opt/gnu-getopt/bin
++ brew --prefix
+ PATH=/usr/local/opt/gnu-getopt/bin:/usr/local/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin
++ getopt --options=hvfp: --longoptions=force,profile:,profiles:,version,help --name aws-rotate-iam-keys -- --version
+ PARSED=' --version --'
+ [[ 0 -ne 0 ]]
+ eval set -- ' --version --'
++ set -- --version --
+ PROFILES=
+ FORCE=
+ true
+ case "$1" in
+ echo 'AWS Rotate IAM Keys (c) 2018+ Adam Link.'
AWS Rotate IAM Keys (c) 2018+ Adam Link.
+ echo 'Licensed under the GNU General Public License.'
Licensed under the GNU General Public License.
+ echo 'Thanks to all the contributors!'
Thanks to all the contributors!
+ echo 'version <%VERSION%>'
version <%VERSION%>
+ exit 0

In previous versions I haven't had an issue with updating both my default and other profiles in the same line in the ~/.aws-rotate-iam-keys file. I noticed just recently that this is failing with the following error:

Rotating keys for profiles: <profile1>,default
Verifying configuration
Verifying credentials
An error occurred (SignatureDoesNotMatch) when calling the ListAccessKeys operation: The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.

I'm looking at this from a management point really. I like the product, I use it on mac and it works, but If I was to expect 100 users to also use it, I would need some form of init script that would take the account names from /.aws/credentials and add this to the .aws-rotate-iam-keys file.

I will submit a PR for this if needs be but I do think an automatic setup option for MacOS would be great, that way I could include this brew formula in an Ansible play that installs all required application on a target machine and I can be content that the user doesn't need to touch it and our key rotation is sorted,

HI ,
I found an issue.
In my case , at least once fail on every 10 attempts

./aws-rotate-iam-keys
Rotating keys for profiles: default
Verifying configuration
Verifying credentials
Creating new access key
Created new key AKXXXXXXXXXXXXXXXX
Verifying new access key
Updating profile: default
Deleting old access key

An error occurred (InvalidClientTokenId) when calling the DeleteAccessKey operation: The security token included in the request is invalid.

version:
/usr/bin/aws-rotate-iam-keys --version
AWS Rotate IAM Keys (c) 2018+ Adam Link.
Licensed under the GNU General Public License.
Thanks to all the contributors!
version 0.9.8.5

Is there any way to debug this issue?
Seems it do not support the "--debug" option

Currently, the rotation script does not rotate AWS Access Keys if two keys are found. Is this intended?

Tried un-tapping and re-tapping the keg. Seems like branch develop was deleted?

$ brew tap rhyeal/aws-rotate-iam-keys https://github.com/rhyeal/aws-rotate-iam-keys
Updating Homebrew...
==> Tapping rhyeal/aws-rotate-iam-keys
Cloning into '/usr/local/Homebrew/Library/Taps/rhyeal/homebrew-aws-rotate-iam-keys'...
remote: Enumerating objects: 44, done.
remote: Counting objects: 100% (44/44), done.
remote: Compressing objects: 100% (38/38), done.
remote: Total 44 (delta 3), reused 28 (delta 1), pack-reused 0
Unpacking objects: 100% (44/44), 82.68 KiB | 1.50 MiB/s, done.
fatal: Not a valid object name develop
Tapped 1 formula (101 files, 286.6KB).

$ brew doctor
Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

fatal: Not a valid object name develop

Fresh install from homebrew (rhyeal/aws-rotate-iam-keys/aws-rotate-iam-keys: stable 0.9.0) gives me this runtime error:

$ aws-rotate-iam-keys
Making new access key
parse error: Invalid numeric literal at line 1, column 10

When checking in IAM, I can see that the script has created a new secondary access key, but has not updated my credentials file, nor removed the old primary key.

Hello - sorry if this is a silly question, I've set this up on linux a lot of times and setting the azure_tenant_id and azure_app_id_uri is pretty simple but I'm stuck with windows.

I've ran the powershell script but don't understand how to set up the config, can anyone help a simpleton?

Could not load profile. Please set up AWS PowerShell Tools first before running this command!

Seeing this warning for brew outdated. It probably appears for other brew commands but this is where I'm seeing it often.

Warning: Calling plist_options is deprecated! Use service.require_root instead.
Please report this issue to the rhyeal/aws-rotate-iam-keys tap (not Homebrew/brew or Homebrew/core), or even better, submit a PR to fix it:
/usr/local/Homebrew/Library/Taps/rhyeal/homebrew-aws-rotate-iam-keys/Formula/aws-rotate-iam-keys.rb:53

I think you updated the sha256 in Formula/aws-rotate-iam-keys.rb but forgot to also update the url to 0.9.5. I am getting a SHA256 mismatch error when installing with brew.

When using the Software Updater program on a scheduled basis to do nightly upgrades, the automatic updater fails when updating versions. However, the program exits before I am able to copy the error log.

Running sudo apt-get upgrade aws-rotate-iam-keys works however.

Using this tool with AWS China is not possible at the moment.
Indeed to you need to specify the region so the aws cli can select the correct endpoint.

I've worked around with a small fix that works for my case, but it might not be perfect for everything.

Thanks :)

The master branch currently has a script that performs a verification of the validity of the newly generated AWS IAM Keys. That verification is missing from the latest release v0.9.2. Furthermore the master branch is 42 commits ahead of the latest release. Are there any plans to create a new release soon?

Greetings,

I'm receiving this error when trying to run the script in a MacOS environment (Mojave).

This is the error i'm receiving:

I'm sorry, -- failed in this environment.

Any idea what it could be? Just to let you know, this is a complete from scratch MacOS installation. All that was installed was from the brew installation only (awscli, jq, etc.)

Thanks in advance!

I see the PPA doesn't yet have a release file for Ubuntu 20.04. Any chance this will be updated soon?

Thanks.

The time randomization portion of the scheduled task creation has the potential to generate invalid times. This is because the minute random number can be generated as a single-digit value. If this is passed directly to the call to create the scheduled task, as it is currently, it generates an "Invalid starttime value" error.

schtasks : ERROR: Invalid starttime value.
At line:1 char:1
+ schtasks /create /f /tn "AWS Rotate IAM Keys" /tr "Powershell.exe -Ex ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (ERROR: Invalid starttime value.:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError

Example:

Get-Random assigners result in the following values:

$hour = 2
$minute = 9

"0$($hour):$minute" outputs 02:9 (resulting in error) whereas the intended value is 02:09

Proposed fix:

Update code section to either

• Exclude single-digit values from the $minute random (Get-Random -Maximum 60 -Minimum 10)
  OR
• Add a check for single digit values and update the value for $minute to add a leading zero.

$minute = Get-Random -Maximum 60
if ($minute -lt 10) { $minute = "0$($minute)" }

I'd be happy to fork and submit a pull request though it'd probably just be easier for you to update it since it should be a one-liner. Thanks!

On my case, the script only works when launch the first time. Then there is an authentication issue and it cannot creates new keys (nor do anything in AWS in fact).

I found after the script is run a first time, 2 profiles "default" exist and can be displayed with the command Get-AWSCredentials -ListProfileDetail:

ProfileName StoreTypeName         ProfileLocation
----------- -------------         ---------------
default     NetSDKCredentialsFile
default     SharedCredentialsFile C:\Users\username\.aws\credentials

I suspect that somehow, when the script updates the profiles, it succeeds for the SharedCredentialsFile but it fails for the NetSDKCredentialsFile. Manually removing the NetSDKCredentialsFile with the command Remove-AWSCredentialProfile -ProfileName default is a workaround to make the script work again once.

The Windows PowerShell script you have provided runs a check to see if the AWS CLI has been installed. However, after reviewing the code, I do not see where the AWS CLI is actually used. I only see commands from the PowerShell module.

I tested without installing the AWS CLI and the script still seems to work. Can you advise if I am missing something or if the check can be ignored/removed?

Also, thank you. This is a great resource!

Re: About the minimal needed IAM permissions for the AWS user

It will be nice if there is a way to change other keys or profiles using a master user/profile? One of the main limitations is that
there are some profiles/users may not have the minimal needed IAM permissions for the AWS user, iam:*AccessKey.

Hi @rhyeal,

I merged the PR to fix the invalid Homebrew devel spec this morning, but the change added by the PR was wiped out by a commit added via the homebrew CircleCI job.

See the latest commit to master, cfe2b1e.

I think the problem might be the restore_cache configuration, which looks like it will restore a cache matching v1-repo-{{ .Branch }} when one matching v1-repo-{{ .Branch }}-{{ .Revision }} is missing.

Symptom

The launchd service that ships with Homebrew formula 0.9.8.4 fails when run. Its logs indicate:

% cat /tmp/homebrew.mxcl.aws-rotate-iam-keys.log
/bin/bash: aws-rotate-iam-keys: command not found

Note: This is a distinct issue from #66 .

Fix

This is because Homebrew (on Apple Silicon Macs only) installs formula to /opt/homebrew,¹ which is not on PATH when the service runs.

Fix for existing Apple Silicon Homebrew (default dir) installations:

patch "$(brew --prefix aws-rotate-iam-keys)/homebrew.mxcl.aws-rotate-iam-keys.plist" <<EOF
8c8
<     <string>/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
---
>     <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
EOF

brew services restart aws-rotate-iam-keys

Fixed by #62
Fixed by #63

Hi,

I'm having several issues when I'm trying to set up a crontab as the README suggests. The job runs and it gives me the following error:

cron[65841]: no path for address 0x1115fa000

I google the error and I tried to add also the path of the script on the top of the file. FYI, I'm using zsh as shell.

Here an example of what I have in the crontab:

Thanks in advance.

This warning message is printed every time homebrew touches the formula. It has been mentioned in another issue. Opening a separate issue to keep it visible.

It's not a blocker. Just a somewhat annoying message. Everything else works fine.

$brew info aws-rotate-iam-keys
Warning: Calling 'devel' blocks in formulae is deprecated! Use 'head' blocks or @-versioned formulae instead.
Please report this issue to the rhyeal/aws-rotate-iam-keys tap (not Homebrew/brew or Homebrew/core), or even better, submit a PR to fix it:
  /usr/local/Homebrew/Library/Taps/rhyeal/homebrew-aws-rotate-iam-keys/Formula/aws-rotate-iam-keys.rb:21

rhyeal/aws-rotate-iam-keys/aws-rotate-iam-keys: stable 0.9.8.1, devel head, HEAD
Automatically rotate your IAM keys daily
....

Hi @rhyeal,

I've created a new release using a simplified build script from a docker container, which seems to have worked fine.

I cannot upload the changes to your PPA though, so could you complete that step as soon as you have time.

I am new to PPA and Debian/Ubuntu packaging in general, so I'm not quite sure which of the build artefacts are required beyond those in the repo, so I'm just going to add them all here (I can't see anything which should not be public)...

aws-rotate-iam-keys_0.9.8.5_dist.zip

Does the PPA will have an update for the Ubuntu version 22.04 jammy?