stefansundin / aws-rotate-key Goto Github PK

When you try to go get this project it now errors with the following:

go: downloading github.com/stefansundin/aws-rotate-key v1.0.7
go get: github.com/stefansundin/[email protected]: parsing go.mod:
        module declares its path as: github.com/Fullscreen/aws-rotate-key
                but was required as: github.com/stefansundin/aws-rotate-key

Even though master is correct the last tagged version has this incorrect module name.

Would be nice to be able to rotate the "other" access key without disabling the current access key.

With longer-running batch processes that only read their credentials once, deactivating the "current" key after rotation may mean disabling a key that's still in use/expected to work.

This would mean a user always has two access keys active, and e.g. every 24h rotates "the older one".

Great tool, thank you for it!

I wonder if you have plans to make it possible to rotate someone else keys instead of the user itself?

I have limited users who do not have iam:* at all and I want to use admin's profile to rotate keys for them from the command line.

I pushed some commits that add support for multiple MFA devices which was released recently [1]. Unfortunately my personal AWS account doesn't have access to this new feature yet (some technical reason [2] is preventing AWS from rolling this out quickly, if you have a recently created AWS account then you probably already have access).

I'm fairly confident that the new code works but I want to test this thoroughly before I release the new version, so I am waiting until I have access. In the mean time if you want to try out the new version you can install it by running:

go install github.com/stefansundin/aws-rotate-key@7ab41aeea7aac0f224c3a86c8627a3c453915f47

This new version also fixes a problem with hardware MFA tokens (they use serial numbers instead of ARNs). I don't have a hardware token so if anyone could test this that would be great!

Let me know if you find any bugs!

1. https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/
2. https://www.reddit.com/r/aws/comments/yx9yr5/comment/iz8e4bd/

Hi there,

You may have noticed that this repository has been moved from Fullscreen/aws-rotate-key to stefansundin/aws-rotate-key.

This program was developed by me a few years ago when I was employed at Fullscreen. We decided to open source it so that it could be to the benefit of everyone who uses AWS. Since that time, I left Fullscreen but I have continued to help maintain this project. We decided that there is no reason to spend precious company time from Fullscreen for the long-term maintenance of this program, so we transferred the repository to my GitHub user.

There are no big changes coming. I plan to introduce a PPA to make the program easier to install on Debian/Ubuntu (hopefully later this week).

I will update the instructions to my own Homebrew tap, but the one that Fullscreen hosts will continue to work for the foreseeable future. There may be a slight lag to get it updated when new versions are released. Update: the official Homebrew repository now includes aws-rotate-key.

I created this issue to explain why the repository was transferred. Please comment if you have any further questions.

I want to thank Fullscreen for allowing us to create cool tools like this one, and I hope lots of companies benefit from it being open source.

Greetings,

When running the script manually it runs smooothly, but running it under cron i'm receiving the following error:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x673d99]

goroutine 1 [running]:
main.main()
	/Users/bivanov/code/fs/aws-rotate-key/main.go:43 +0x2129

Any idea what that could be?

Hi everyone,

If someone would like to submit aws-rotate-key to the official homebrew repository, that would be great. I was researching it, but apparently it is frowned upon to submit your own work. Yeah, that is a funny rule, but it's a rule.

I know that my Homebrew tap should work well for almost everyone, but it also makes some other formulas available that are not related to this project.

If you'd like to help me submit this to Homebrew/homebrew-core, then please feel free to attempt to submit it, and report back here.

Here are some links to get started:

• https://github.com/Homebrew/brew/blob/master/docs/Acceptable-Formulae.md
• Current formula (may or may not be of value): https://github.com/stefansundin/homebrew-tap/blob/master/Formula/aws-rotate-key.rb
• Homebrew install stats (search for "aws-rotate-key", note that there are two taps): https://formulae.brew.sh/analytics/install/365d/

Thanks!

aws-rotate-keys fails on Ubuntu 18.04.1 LTS (Bionic Beaver) with the following error message:

Using access key <AWS_OLD_ACCESS_KEY> from profile "<AWS_PROFILE>".
Your user arn is: <ARN>

You have 1 access key associated with your user:
- <AWS_OLD_ACCESS_KEY> (Active, created <CREATED_TIMESTAMP>, last used <LAST_USED_TIMESTAMP> for service <SERVICE> in <AWS_REGION>)

Do you want to create a new key and deactivate <AWS_OLD_ACCESS_KEY>? [yN] y
Created access key <AWS_NEW_ACCESS_KEY>.
Failed to replace old access key. Aborting.
Please verify that the file <HOME_DIR>/.aws/credentials is formatted correctly.
Deleted access key <AWS_NEW_ACCESS_KEY>.

According to colleagues, this issue also appeared on MacOS

Any potential plans for integration with HashiCorp Vault?

Would be a nice feature.
Sorry, I'm not a gopher and don't know the Go AWS SDK.

That's not really an issue and feel free to close it, but I was thinking (and that's only a suggestion) about fully automating aws key rotation: what if a program can perform AWS API call to import all AWS IAM users, and create new keys per each user, store it in .csv file and then use AWS SNS service to notify each user about new keys? That would be cool to work on and that's what has been on my mind for the last few weeks and just today I came across your repo