Add unused access key policy

[ebattat]

Type of change

Note: Fill x in []

• bug
• enhancement
• documentation
• dependencies

Description

Unused Access Key Policy:
Deactivate user access keys that are still active but have not been used in the last 90 days.
The threshold is defined by a constant parameter: UNUSED_ACCESS_KEY_DAYS = 90.
Solved Issue

For security reasons, all pull requests need to be approved first before running any automated CI

[athiruma]

We need to deactivate unused keys, not all keys. Her we should pass the inactive key_id to deactivate.

[ebattat]

We deactivate it by resource_id=user_name.
You can find here the way we deactivate only specific user as other policies.
Pls let me know if it is ok.

[athiruma]

Yeah, but if the user having multiple access_keys and one is recently used and one is used 90days back. We should delete the key that not using.

[ebattat]

Lets have an example:
User1 -
AccessKey1 - Active - last used - 91 days
AccessKey2 - Active - last used - 27 days
We will deactivate only AccessKey1, and not change AccessKey2 according what we found here

My question is: do we pass to here only the suspected users that we found here

[athiruma]

Suggested change

	for username, user_data in iam_users_access_keys.items():
	last_activity_days = user_data['last_activity_days']
	# Collect age_days only for active access keys
	age_days_list = [
	value[1] for key, value in user_data.items()
	if key.startswith("Access key") and isinstance(value, list) and value[0] == "active"
	]
	# "N/A"/None implies unused access key — fallback to UNUSED_ACCESS_KEY_MAX_DAY
	age_days = min(age_days_list) if age_days_list else UNUSED_ACCESS_KEY_MAX_DAY
	# if access key last_activity_days is "N/A", use age_days
	if last_activity_days == "N/A":
	last_activity_days = age_days
	region = user_data['region']
	user_name = username
	for user_name, user_data in iam_users_access_keys.items():
	last_activity_days = user_data['last_activity_days']
	# Collect age_days only for active access keys
	age_days_list = [
	value[1] for key, value in user_data.items()
	if key.startswith("Access key") and isinstance(value, list) and value[0] == "active"
	]
	# "N/A"/None implies unused access key — fallback to UNUSED_ACCESS_KEY_MAX_DAY
	age_days = min(age_days_list) if age_days_list else UNUSED_ACCESS_KEY_MAX_DAY
	# if access key last_activity_days is "N/A", use age_days
	if last_activity_days == "N/A":
	last_activity_days = age_days
	region = user_data['region']

[athiruma]

we need to pass the de-activate key-id.

[ebattat]

I pass the resource_id which contains the user_name with the unused key.
Here we collect all the suspected user_name.

[athiruma]

Have you did the dry_run?

[ebattat]

I run it locally and it works ok.
If we merge it, this policy will run as dry_run=yes in default, right ?

[athiruma]

I run it locally and it works ok. If we merge it, this policy will run as dry_run=yes in default, right ?

ack, yes by default it will run dry_run=yes

[ebattat]

@athiruma,
I have updated the code based on your important comment.
Now, for each user, I have added an access_key_label to indicate "Access key 1" or "Access key 2."
By passing the access_key_label instead of the access_key_id, we keep our code more secure.
This means there are two checks per user, and each can trigger a different alert.
Additionally, we have added **kwargs to self._delete_resource(resource_id=resource_id, **kwargs) to allow passing more than one parameter—such as the user name and the access key label.

[athiruma]

/lgtm