{"id":16151205,"url":"https://github.com/stefansundin/aws-rotate-key","last_synced_at":"2025-12-15T04:01:41.477Z","repository":{"id":33851815,"uuid":"67648000","full_name":"stefansundin/aws-rotate-key","owner":"stefansundin","description":"Easily rotate your AWS access key. :key:","archived":false,"fork":false,"pushed_at":"2024-10-07T06:06:37.000Z","size":150,"stargazers_count":384,"open_issues_count":3,"forks_count":51,"subscribers_count":12,"default_branch":"main","last_synced_at":"2025-09-15T11:49:26.270Z","etag":null,"topics":["aws","cli","security-tools"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"Fullscreen/aws-rotate-key","license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/stefansundin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":["stefansundin"],"patreon":"stefansundin","ko_fi":"stefansundin","custom":"https://paypal.me/stefansundin"}},"created_at":"2016-09-07T22:23:54.000Z","updated_at":"2025-03-07T19:55:25.000Z","dependencies_parsed_at":"2025-01-10T22:11:47.415Z","dependency_job_id":"3a8072e1-d727-4ab9-925e-3857e5de0dc7","html_url":"https://github.com/stefansundin/aws-rotate-key","commit_stats":{"total_commits":69,"total_committers":10,"mean_commits":6.9,"dds":0.2028985507246377,"last_synced_commit":"0686e9978ab3647d3f793871ed0fcfe43fe6c37b"},"previous_names":["fullscreen/aws-rotate-key"],"tags_count":11,"template":false,"template_full_name":null,"purl":"pkg:github/stefansundin/aws-rotate-key","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stefansundin%2Faws-rotate-key","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stefansundin%2Faws-rotate-key/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stefansundin%2Faws-rotate-key/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stefansundin%2Faws-rotate-key/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/stefansundin","download_url":"https://codeload.github.com/stefansundin/aws-rotate-key/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stefansundin%2Faws-rotate-key/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":27538395,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-12-06T02:00:06.463Z","response_time":60,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","cli","security-tools"],"created_at":"2024-10-10T00:55:05.287Z","updated_at":"2025-12-15T04:01:41.457Z","avatar_url":"https://github.com/stefansundin.png","language":"Go","funding_links":["https://github.com/sponsors/stefansundin","https://patreon.com/stefansundin","https://ko-fi.com/stefansundin","https://paypal.me/stefansundin"],"categories":[],"sub_categories":[],"readme":"# aws-rotate-key\n\nAs a security best practice, AWS recommends that users periodically\n[regenerate their API access keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_RotateAccessKey).\nThis tool simplifies the rotation of access keys defined in your\n[credentials file](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html).\n\nWhen run, the program will list the current access keys associated with your\nIAM user, and print the steps it has to perform to rotate them.\nIt will then wait for your confirmation before continuing.\n\n## Usage\n\n```\n$ aws-rotate-key --help\nUsage of aws-rotate-key:\n  -auth-profile string\n    \tUse a different profile when calling AWS.\n  -d\tDelete the old key instead of deactivating it.\n  -mfa\n    \tUse MFA.\n  -mfa-serial-number string\n    \tSpecify the MFA device to use. (optional)\n  -profile string\n    \tThe profile to use. (default \"default\")\n  -version\n    \tPrint version number\n  -y\tAutomatic \"yes\" to prompts.\n```\n\n## Example\n\n```\n$ aws-rotate-key --profile work\nUsing access key AKIAJMIGD6UPCXCFWVOA from profile \"work\".\nYour user ARN is: arn:aws:iam::123456789012:user/your_username\n\nYour user has 2 access keys:\n- AKIAI3KI7UC6BPI4O57A (Inactive, created 2018-11-22 21:47:46 +0000 UTC, last used 2018-11-30 20:35:41 +0000 UTC for service s3 in us-west-2)\n- AKIAJMIGD6UPCXCFWVOA (Active, created 2018-11-30 21:55:57 +0000 UTC, last used 2018-12-20 12:14:10 +0000 UTC for service s3 in us-west-2)\n\nYou have two access keys, which is the maximum number of access keys allowed.\nDo you want to delete AKIAI3KI7UC6BPI4O57A and create a new key? [yN] y\nDeleted access key: AKIAI3KI7UC6BPI4O57A\nCreated access key: AKIAIX46CKYT7E5I3KVQ\nWrote new key pair to /Users/your_username/.aws/credentials\nDeactivated old access key: AKIAJMIGD6UPCXCFWVOA\nPlease make sure this key is not used elsewhere.\nPlease note that it may take a minute for your new access key to propagate in the AWS control plane.\n```\n\n## Install\n\nYou can download binaries from [the releases section](https://github.com/stefansundin/aws-rotate-key/releases/latest).\n\nYou can use Homebrew to install on macOS:\n\n```shell\nbrew install aws-rotate-key\n```\n\nYou can install [using a PPA](https://launchpad.net/~stefansundin/+archive/ubuntu/aws-rotate-key) on Ubuntu Linux:\n\n```shell\nsudo add-apt-repository ppa:stefansundin/aws-rotate-key\nsudo apt install aws-rotate-key\n```\n\nIf you have Go installed then you can download and build the program using:\n\n```shell\ngo install github.com/stefansundin/aws-rotate-key@latest\n```\n\n## Setup\n\nMake sure your users have permissions to update their own access keys.\nThe following AWS documentation page explains the required permissions:\nhttps://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_delegate-permissions_examples.html.\n\nThe following IAM policy is enough for aws-rotate-key:\n\n```json\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"iam:ListAccessKeys\",\n                \"iam:GetAccessKeyLastUsed\",\n                \"iam:DeleteAccessKey\",\n                \"iam:CreateAccessKey\",\n                \"iam:UpdateAccessKey\"\n            ],\n            \"Resource\": [\n                \"arn:aws:iam::AWS_ACCOUNT_ID:user/${aws:username}\"\n            ]\n        }\n    ]\n}\n```\n\n\u003e [!WARNING]\n\u003e Replace `AWS_ACCOUNT_ID` with your AWS account id.\n\n### Require MFA\n\nYou can require MFA by adding a `Condition` clause. Please note that you\nhave to use the `-mfa` option when running the program.\n\n```json\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"iam:ListMFADevices\"\n            ],\n            \"Resource\": [\n                \"arn:aws:iam::AWS_ACCOUNT_ID:user/${aws:username}\"\n            ]\n        },\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"iam:ListAccessKeys\",\n                \"iam:GetAccessKeyLastUsed\",\n                \"iam:DeleteAccessKey\",\n                \"iam:CreateAccessKey\",\n                \"iam:UpdateAccessKey\"\n            ],\n            \"Resource\": [\n                \"arn:aws:iam::AWS_ACCOUNT_ID:user/${aws:username}\"\n            ],\n            \"Condition\": {\n                \"Bool\": {\n                    \"aws:MultiFactorAuthPresent\": true\n                }\n            }\n        }\n    ]\n}\n```\n\nNote that this makes it harder to rotate access keys using aws-cli commands,\nas it only supports MFA when assuming roles. You will still be able to use\nthe AWS management console.\n\n## Contribute\n\nTo download and hack on the source code, run:\n\n```shell\ngit clone https://github.com/stefansundin/aws-rotate-key.git\ncd aws-rotate-key\ngo build\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstefansundin%2Faws-rotate-key","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstefansundin%2Faws-rotate-key","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstefansundin%2Faws-rotate-key/lists"}