{"id":16978590,"url":"https://github.com/willdady/cdk-iam-credentials-rotator","last_synced_at":"2025-04-12T01:21:12.074Z","repository":{"id":38390021,"uuid":"471898828","full_name":"willdady/cdk-iam-credentials-rotator","owner":"willdady","description":"AWS CDK construct for rotating IAM user credentials and sending to a third party","archived":false,"fork":false,"pushed_at":"2022-08-28T12:14:19.000Z","size":802,"stargazers_count":17,"open_issues_count":1,"forks_count":1,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-03-25T21:03:12.547Z","etag":null,"topics":["aws","cdk","cdk-construct","iam","serverless"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/willdady.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-03-20T06:33:13.000Z","updated_at":"2024-02-13T14:27:12.000Z","dependencies_parsed_at":"2022-07-16T09:46:32.075Z","dependency_job_id":null,"html_url":"https://github.com/willdady/cdk-iam-credentials-rotator","commit_stats":null,"previous_names":[],"tags_count":18,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/willdady%2Fcdk-iam-credentials-rotator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/willdady%2Fcdk-iam-credentials-rotator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/willdady%2Fcdk-iam-credentials-rotator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/willdady%2Fcdk-iam-credentials-rotator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/willdady","download_url":"https://codeload.github.com/willdady/cdk-iam-credentials-rotator/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248501855,"owners_count":21114684,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","cdk","cdk-construct","iam","serverless"],"created_at":"2024-10-14T01:43:46.244Z","updated_at":"2025-04-12T01:21:12.054Z","avatar_url":"https://github.com/willdady.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# IAM Credentials Rotator\n\nAWS CDK construct for rotating IAM user credentials and sending to a third party.\n\n## Usage\n\nSimply provide a list of user objects where each object contains a `username` of an IAM user which exists in the target account.\n\n```typescript\nconst myCredentialsHandler = new lambda.Function(this, 'MyCredentialsHandler', {\n  handler: 'index.handler',\n  code: lambda.Code.fromAsset('path/to/your/code'),\n  runtime: lambda.Runtime.NODEJS_14_X,\n});\n\nnew IamCredentialsRotator(this, 'MyCredentialsRotator', {\n  users: [\n    { username: 'homer' }, \n    { username: 'marge' }, \n    { username: 'bart' }, \n    { username: 'lisa' }, \n    { username: 'maggie' }\n  ],\n  credentialsHandler: myCredentialsHandler,\n});\n```\n\nEach user object supports an optional `metadata` key which can contain arbitrary string data. Do not store large or sensitive values in `metadata`. The `users` array is stored in a single AWS Parameter Store parameter which has a maximum size limit of 4KB.\n\nThe Lambda function, `credentialsHandler`, is called immediately after a new access key is created for a user. The newly created credentials must be retrieved from AWS Secrets Manager using `secretName` included in the function's event. \n\nBy default, credentials are rotated once an hour. This can be changed by providing `scheduleDuration` in the constructor.\n\nBelow is a minimal boilerplate for your handler function.\n\n```typescript\nimport {\n  SecretsManagerClient,\n  GetSecretValueCommand,\n} from '@aws-sdk/client-secrets-manager';\n\nconst secretsManagerClient = new SecretsManagerClient({});\n\ninterface Event {\n  username: string;\n  secretName: string;\n  metadata?: string;\n}\n\nexport async function handler(event: Event) {\n  const { username, secretName } = event;\n  const getSecretResponse = await secretsManagerClient.send(\n    new GetSecretValueCommand({ SecretId: secretName }),\n  );\n  const { AccessKeyId, SecretAccessKey }: { [key: string]: string } =\n    JSON.parse(getSecretResponse.SecretString || '');\n\n  // Do something with AccessKeyId and SecretAccessKey here e.g. send to a trusted third-party\n}\n```\n\nOnce your function exits the underlying AWS Step Functions workflow will wait a period of time before deleting the old credentials. During this period both the old and new credentials for the user exist. At the end of this period the old credentials are deleted.\n\nThe amount of time to wait before deleting old credentials defaults to 5 minutes and can be adjusted by setting `cleanupWaitDuration`. This value MUST be less-than `scheduleDuration`.\n\n## Architecture\n\n![Architecture diagram](images/diagram.png)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwilldady%2Fcdk-iam-credentials-rotator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwilldady%2Fcdk-iam-credentials-rotator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwilldady%2Fcdk-iam-credentials-rotator/lists"}