IAM access key restriction

Restricts who can create IAM access keys, allowing them only for automation roles to reduce credential sprawl.

Policy description

What this SCP does

This Service Control Policy (SCP) restricts who can create IAM access keys, allowing them only for automation roles to reduce credential sprawl. This improves security by limiting long-term credentials.

The policy denies the creation of IAM access keys for any principal that doesn't have an ARN matching the pattern "arn:aws:iam::*:role/Automation*". This ensures that only roles specifically designed for automation can create access keys, reducing the risk of unnecessary long-term credentials.

Validation strategy

How to test this SCP works

To validate this SCP, try to create access keys for different IAM roles and users:

Invalid test: Create an access key for a regular user (should be denied)
Valid test: Create an access key for a user when assuming an Automation* role (should succeed)

We expect access key creation to be denied with an AccessDenied error when attempted by any principal that doesn't match the "arn:aws:iam::*:role/Automation*" pattern. Note that testing this effectively requires assuming different roles, which can be complex in a test environment.

SCP policy & validation scenarios

{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyIAMAccessKeyCreation", "Effect": "Deny", "Action": "iam:CreateAccessKey", "Resource": "*", "Condition": { "ArnNotLike": { "aws:PrincipalArn": "arn:aws:iam::*:role/Automation*" } } } ] }

# Create a test user (should be denied for access key creation) aws iam create-user --user-name test-regular-user # Create a trust policy for the automation role cat > trust-policy.json <<EOF { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "ec2.amazonaws.com" }, "Action": "sts:AssumeRole" } ] } EOF # Create an automation role (if allowed) aws iam create-role \ --role-name Automation-Test \ --assume-role-policy-document file://trust-policy.json # Try to create an access key for the regular user (should be denied) aws iam create-access-key --user-name test-regular-user # Create a service user (automation user) aws iam create-user --user-name test-automation-user # IMPORTANT: To create an access key for the automation user, you must: # 1. Attach the necessary policy to the automation user. # 2. Assume the Automation-Test role and use the temporary credentials. # 3. Then run: # aws iam create-access-key --user-name test-automation-user # If you do NOT assume the role, this will be denied by the SCP.

import boto3 import json # Initialize IAM client iam_client = boto3.client('iam') # Create a test user (if allowed) try: iam_client.create_user(UserName='test-regular-user') print("Created regular test user") # Try to create an access key for the user (this should be denied) try: response = iam_client.create_access_key(UserName='test-regular-user') print("WARNING: Successfully created access key for regular user") print("This means the SCP is NOT restricting as expected") except Exception as e: print(f"Expected error for regular user if SCP is working: {e}") # Clean up try: iam_client.delete_user(UserName='test-regular-user') except: pass except Exception as e: print(f"Could not create test user: {e}") # Create an automation role (if allowed) try: trust_policy = { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": {"Service": "lambda.amazonaws.com"}, "Action": "sts:AssumeRole" } ] } iam_client.create_role( RoleName='Automation-Test', AssumeRolePolicyDocument=json.dumps(trust_policy) ) print("Created automation test role") # Create a service user that might be allowed to have access keys try: iam_client.create_user(UserName='test-automation-user') print("Created automation test user") # Try to create an access key for the automation user try: response = iam_client.create_access_key(UserName='test-automation-user') print("Successfully created access key for automation user") except Exception as e: print(f"Error creating access key for automation user: {e}") # Clean up try: iam_client.delete_user(UserName='test-automation-user') except: pass except Exception as e: print(f"Could not create automation user: {e}") # Clean up try: iam_client.delete_role(RoleName='Automation-Test') except: pass except Exception as e: print(f"Could not create automation role: {e}")