{"id":21107146,"url":"https://github.com/billtrust/aws-iam-user-tool","last_synced_at":"2025-07-08T16:31:34.067Z","repository":{"id":83361326,"uuid":"131782792","full_name":"billtrust/aws-iam-user-tool","owner":"billtrust","description":"A command line tool to create AWS IAM users, set permissions, and send a welcome email to the newly created user with all necessary login and usage information.","archived":false,"fork":false,"pushed_at":"2018-08-23T18:52:08.000Z","size":27,"stargazers_count":15,"open_issues_count":0,"forks_count":4,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-04-04T06:33:15.479Z","etag":null,"topics":["aws","iam","iam-users"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/billtrust.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.TXT","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-05-02T01:38:03.000Z","updated_at":"2022-02-18T15:02:35.000Z","dependencies_parsed_at":null,"dependency_job_id":"52f5a5a3-fb36-4b08-93d4-73452d813a93","html_url":"https://github.com/billtrust/aws-iam-user-tool","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/billtrust/aws-iam-user-tool","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/billtrust%2Faws-iam-user-tool","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/billtrust%2Faws-iam-user-tool/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/billtrust%2Faws-iam-user-tool/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/billtrust%2Faws-iam-user-tool/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/billtrust","download_url":"https://codeload.github.com/billtrust/aws-iam-user-tool/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/billtrust%2Faws-iam-user-tool/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264304583,"owners_count":23587989,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","iam","iam-users"],"created_at":"2024-11-20T00:36:14.803Z","updated_at":"2025-07-08T16:31:34.060Z","avatar_url":"https://github.com/billtrust.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# AWS IAM User Tool\n\nA command line tool to create AWS IAM users, set permissions, and send a welcome email to the newly created user with all necessary login and usage information.\n\nSee a [sample](http://htmlpreview.github.io/?https://github.com/billtrust/aws-iam-user-tool/blob/master/sample_email.html) of the welcome email this tool sends out when creating a new IAM user.\n\n## Features\n\n* Create the user and assign to the specified IAM groups.\n* Encrypts the password via Privnote.com for secure distribution with self destruct after the password link is clicked.\n* Auto discovers your account's password policy and includes these details in the welcome email.\n* Auto discovers your cross account IAM role configuration and includes switch account URLs in the welcome email.\n* Auto discovers your account's login URL with alias and includes this in the welcome email.\n* Emails the user a welcome email with all necessary information to setup MFA and access their account.\n\n## Build\n\n```\ndocker build -t billtrust/aws-iam-user-tool:latest .\n```\n\n## Setup\n\n### Setup - One time Creation of AWS Resources and Setting Configuration\n\nTo run the Terraform script to create the SES email template and other AWS resources, the below is required to run one as a pre-requisite.  If the `/content/welcome_email.html` template changes, this will need to be run again.  This will also run the premailer program to inline the css and create the `/content/welcome_email_cssinline.html` file.\n\n```\ndocker run \\\n    -e AWS_ACCESS_KEY_ID=\u003c\u003cYOURKEY\u003e\u003e \\\n    -e AWS_SECRET_ACCESS_KEY=\u003c\u003cYOURSECRET\u003e\u003e \\\n    -e AWS_DEFAULT_REGION=us-east-1 \\\n    --entrypoint python \\\n    billtrust/aws-iam-user-tool:latest \\\n    /src/provision.py \\\n    --tfstate-bucket mycompany-tfstate \\\n    --tfstate-dynamotable tfstate \\\n    --email-from-address noreply@aws-dev.billtrust.com \\\n    --email-replyto-address noreply@aws-dev.billtrust.com \\\n    --email-bcc-address this-is-optional@mycompany.com\n```\n\nThe AWS creds provided above must be sufficient to create/access all AWS resosurces required, including IAM, SES, S3, and DynamoDb (for Terraform state).  See the \"terraform\" folder to see exactly which resources are created.  Terraform is configured here to remotely store its tfstate files in S3.  As such, the creds you supply additionally need to be able to read and write from the S3 bucket you designate via the `--tfstate-bucket` argument your administrative creds, and the DyanamoDB table you designate via the `--tfstate-dynamotable` argument.\n\n### Setup - Terraform RemoteState Bucket\n\nIf you have not yet setup remote state in Terraform, you'll just need to create the S3 bucket you want to use for state.  Terraform will take care of writing to it and creating the DynamoDB lock table.  This is the bucket name referred to in the above argument `--tfstate-bucket`.\n\nYou can create a bucket however you like, including by the following AWS CLI command:\n\n```\naws s3api create-bucket --bucket mycompany-terraform-tfstate --region us-east-1 --acl private\n```\n\n### Setup - SES Domain Verification\n\nSES will not send emails until you have verified a domain for use with SES.  If you have not already configured SES for use with your email, see the instructions below:\n\nVerifying a Domain With Amazon SES:\nhttps://docs.aws.amazon.com/ses/latest/DeveloperGuide/verify-domain-procedure.html\n\nOr to verify just a single email address for testing:\nhttps://docs.aws.amazon.com/ses/latest/DeveloperGuide/verify-email-addresses-procedure.html\n\n## Prerequisites\n\nYou will need the following installed on your workstation to use this tool.\n\n* Docker\n* Python\n* Boto3 - `pip install boto3` if not already installed\n* A default AWS profile which has credentials to assume the role `bt-policy-aws-iam-user-tool`.  If you would like to use a different profile, change the `--local-aws-profile` argument to specify the profile name.\n\n## Usage\n\nTo create a user execute `iamtool.py` passing arguments for the username, email, and IAM groups the user should belong to.\n\nExample:\n```shell\n# make sure to build first, the image is not currently published to docker hub\ndocker build -t billtrust/aws-iam-user-tool:latest .\n# iamtool.py generates AWS temp credentials and executes the tool within a container\npython ./iamtool.py \\\n    create \\\n    --user-name testuser \\\n    --user-email testuser@mycompany.com \\\n    --iam-group master-allusers \\\n    --iam-group dev-developers \\\n    --iam-group stage-developers \\\n    --iam-group prod-developers \\\n    --region us-east-1 \\\n    --profile default\n```\n\n## Run Tests\n\nTo run unit tests simply execute `python run_tests.py` which will run the unit tests inside the container.\n\n## License\n\nMIT License\n\nCopyright (c) 2018 Factor Systems Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbilltrust%2Faws-iam-user-tool","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbilltrust%2Faws-iam-user-tool","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbilltrust%2Faws-iam-user-tool/lists"}