AWS SDK 또는 CLI로 ListAccessKeys 사용하기

다음 코드 예시는 ListAccessKeys을(를) 사용하는 방법을 보여줘요.

액션 예시는 더 큰 프로그램에서 발췌한 코드 조각이라, 실제 프로그램 컨텍스트 안에서 실행돼야 해요.

본문

AWS CLI with Bash script

###############################################################################
# function errecho
#
# This function outputs everything sent to it to STDERR (standard error output).
###############################################################################
function errecho()
{

  printf "%s\n" "$*" 1>&2
}

###############################################################################
# function iam_list_access_keys
#
# This function lists the access keys for the specified user.
#
# Parameters:
#       -u user_name -- The name of the IAM user.
#
# Returns:
#       access_key_ids
#     And:
#       0 - If successful.
#       1 - If it fails.
###############################################################################
function iam_list_access_keys()
{


  # bashsupport disable=BP5008
  function usage()
{

    echo "function iam_list_access_keys"
    echo "Lists the AWS Identity and Access Management (IAM) access key IDs for the specified user."
    echo "  -u user_name   The name of the IAM user."
    echo ""
  }

  local user_name response
  local option OPTARG # Required to use getopts command in a function.
  # Retrieve the calling parameters.
  while getopts "u:h" option; do
    case "$
{
option}" in
      u) user_name="$
{
OPTARG}" ;;
      h)
        usage
        return 0
        ;;
      \?)
        echo "Invalid parameter"
        usage
        return 1
        ;;
    esac
  done
  export OPTIND=1

  if [[ -z "$user_name" ]]; then
    errecho "ERROR: You must provide a username with the -u parameter."
    usage
    return 1
  fi

  response=$(aws iam list-access-keys \
    --user-name "$user_name" \
    --output text \
    --query 'AccessKeyMetadata[].AccessKeyId')

  local error_code=$
{
?}

  if [[ $error_code -ne 0 ]]; then
    aws_cli_error_log $error_code
    errecho "ERROR: AWS reports list-access-keys operation failed.$response"
    return 1
  fi

  echo "$response"

  return 0
}

API 상세 내용은 AWS CLI Command Reference의 ListAccessKeys 문서를 참고하세요.

SDK for C++

bool AwsDoc::IAM::listAccessKeys(const Aws::String &userName,
                                 const Aws::Client::ClientConfiguration &clientConfig)
{

    Aws::IAM::IAMClient iam(clientConfig);
    Aws::IAM::Model::ListAccessKeysRequest request;
    request.SetUserName(userName);

    bool done = false;
    bool header = false;
    while (!done)
{

        auto outcome = iam.ListAccessKeys(request);
        if (!outcome.IsSuccess())
{

            std::cerr << "Failed to list access keys for user " << userName
                      << ": " << outcome.GetError().GetMessage() << std::endl;
            return false;
        }

        if (!header)
{

            std::cout << std::left << std::setw(32) << "UserName" <<
                      std::setw(30) << "KeyID" << std::setw(20) << "Status" <<
                      std::setw(20) << "CreateDate" << std::endl;
            header = true;
        }

        const auto &keys = outcome.GetResult().GetAccessKeyMetadata();
        const Aws::String DATE_FORMAT = "%Y-%m-%d";

        for (const auto &key: keys)
{

            Aws::String statusString =
                    Aws::IAM::Model::StatusTypeMapper::GetNameForStatusType(
                            key.GetStatus());
            std::cout << std::left << std::setw(32) << key.GetUserName() <<
                      std::setw(30) << key.GetAccessKeyId() << std::setw(20) <<
                      statusString << std::setw(20) <<
                      key.GetCreateDate().ToGmtString(DATE_FORMAT.c_str()) << std::endl;
        }

        if (outcome.GetResult().GetIsTruncated())
{

            request.SetMarker(outcome.GetResult().GetMarker());
        }
        else
{

            done = true;
        }
    }

    return true;
}

API 상세 내용은 AWS SDK for C++ API Reference의 ListAccessKeys 문서를 참고하세요.

AWS CLI

IAM 사용자의 액세스 키 ID를 나열하려면

다음 list-access-keys 명령은 Bob IAM 사용자의 액세스 키 ID를 나열해요.

aws iam list-access-keys \
    --user-name
Bob

출력:

{

    "AccessKeyMetadata": [

{

            "UserName": "Bob",
            "Status": "Active",
            "CreateDate": "2013-06-04T18:17:34Z",
            "AccessKeyId": "AKIAIOSFODNN7EXAMPLE"
        },

{

            "UserName": "Bob",
            "Status": "Inactive",
            "CreateDate": "2013-06-06T20:42:26Z",
            "AccessKeyId": "AKIAI44QH8DHBEXAMPLE"
        }
    ]
}

IAM 사용자의 비밀 액세스 키는 나열할 수 없어요. 비밀 액세스 키를 잃어버리면 create-access-keys 명령으로 새 액세스 키를 만들어야 해요.

더 자세한 내용은 AWS IAM 사용자 가이드의 'IAM 사용자의 액세스 키 관리' 문서를 참고하세요.

API 상세 내용은 AWS CLI Command Reference의 ListAccessKeys 문서를 참고하세요.

SDK for Go V2

import (
	"context"
	"encoding/json"
	"errors"
	"log"

	"github.com/aws/aws-sdk-go-v2/aws"
	"github.com/aws/aws-sdk-go-v2/service/iam"
	"github.com/aws/aws-sdk-go-v2/service/iam/types"
	"github.com/aws/smithy-go"
)

// UserWrapper encapsulates user actions used in the examples.
// It contains an IAM service client that is used to perform user actions.
type UserWrapper struct
{

	IamClient *iam.Client
}



// ListAccessKeys lists the access keys for the specified user.
func (wrapper UserWrapper) ListAccessKeys(ctx context.Context, userName string) ([]types.AccessKeyMetadata, error)
{

	var keys []types.AccessKeyMetadata
	result, err := wrapper.IamClient.ListAccessKeys(ctx, &iam.ListAccessKeysInput
{

		UserName: aws.String(userName),
	})
	if err != nil
{

		log.Printf("Couldn't list access keys for user %v. Here's why: %v\n", userName, err)
	} else
{

		keys = result.AccessKeyMetadata
	}
	return keys, err
}

API 상세 내용은 AWS SDK for Go API Reference의 ListAccessKeys 문서를 참고하세요.

SDK for Java 2.x

import software.amazon.awssdk.services.iam.model.AccessKeyMetadata;
import software.amazon.awssdk.services.iam.model.IamException;
import software.amazon.awssdk.services.iam.model.ListAccessKeysRequest;
import software.amazon.awssdk.services.iam.model.ListAccessKeysResponse;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.iam.IamClient;

/**
 * Before running this Java V2 code example, set up your development
 * environment, including your credentials.
 *
 * For more information, see the following documentation topic:
 *
 * https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
 */
public class ListAccessKeys
{

    public static void main(String[] args)
{

        final String usage = """

                Usage:
                    <userName>\s

                Where:
                    userName - The name of the user for which access keys are retrieved.\s
                """;

        if (args.length != 1)
{

            System.out.println(usage);
            System.exit(1);
        }

        String userName = args[0];
        Region region = Region.AWS_GLOBAL;
        IamClient iam = IamClient.builder()
                .region(region)
                .build();

        listKeys(iam, userName);
        System.out.println("Done");
        iam.close();
    }

    public static void listKeys(IamClient iam, String userName)
{

        try
{

            boolean done = false;
            String newMarker = null;

            while (!done)
{

                ListAccessKeysResponse response;

                if (newMarker == null)
{

                    ListAccessKeysRequest request = ListAccessKeysRequest.builder()
                            .userName(userName)
                            .build();

                    response = iam.listAccessKeys(request);

                } else
{

                    ListAccessKeysRequest request = ListAccessKeysRequest.builder()
                            .userName(userName)
                            .marker(newMarker)
                            .build();

                    response = iam.listAccessKeys(request);
                }

                for (AccessKeyMetadata metadata : response.accessKeyMetadata())
{

                    System.out.format("Retrieved access key %s", metadata.accessKeyId());
                }

                if (!response.isTruncated())
{

                    done = true;
                } else
{

                    newMarker = response.marker();
                }
            }

        } catch (IamException e)
{

            System.err.println(e.awsErrorDetails().errorMessage());
            System.exit(1);
        }
    }
}

API 상세 내용은 AWS SDK for Java 2.x API Reference의 ListAccessKeys 문서를 참고하세요.

SDK for JavaScript (v3)

액세스 키를 나열해요.

import
{
 ListAccessKeysCommand, IAMClient } from "@aws-sdk/client-iam";

const client = new IAMClient(
{
});

/**
 * A generator function that handles paginated results.
 * The AWS SDK for JavaScript (v3) provides
{
@link https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/index.html#paginators | paginator} functions to simplify this.
 *
 * @param
{
string} userName
 */
export async function* listAccessKeys(userName)
{

  const command = new ListAccessKeysCommand(
{

    MaxItems: 5,
    UserName: userName,
  });

  /**
   * @type
{
import("@aws-sdk/client-iam").ListAccessKeysCommandOutput | undefined}
   */
  let response = await client.send(command);

  while (response?.AccessKeyMetadata?.length)
{

    for (const key of response.AccessKeyMetadata)
{

      yield key;
    }

    if (response.IsTruncated)
{

      response = await client.send(
        new ListAccessKeysCommand(
{

          Marker: response.Marker,
        }),
      );
    } else
{

      break;
    }
  }
}

더 자세한 내용은 AWS SDK for JavaScript 개발자 가이드를 참고하세요.

API 상세 내용은 AWS SDK for JavaScript API Reference의 ListAccessKeys 문서를 참고하세요.

SDK for JavaScript (v2)

// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update(
{
 region: "REGION" });

// Create the IAM service object
var iam = new AWS.IAM(
{
 apiVersion: "2010-05-08" });

var params =
{

  MaxItems: 5,
  UserName: "IAM_USER_NAME",
};

iam.listAccessKeys(params, function (err, data)
{

  if (err)
{

    console.log("Error", err);
  } else
{

    console.log("Success", data);
  }
});

더 자세한 내용은 AWS SDK for JavaScript 개발자 가이드를 참고하세요.

API 상세 내용은 AWS SDK for JavaScript API Reference의 ListAccessKeys 문서를 참고하세요.

SDK for Kotlin

suspend fun listKeys(userNameVal: String?)
{

    val request =
        ListAccessKeysRequest
{

            userName = userNameVal
        }
    IamClient.fromEnvironment
{
 region = "AWS_GLOBAL" }.use
{
 iamClient ->
        val response = iamClient.listAccessKeys(request)
        response.accessKeyMetadata?.forEach
{
 md ->
            println("Retrieved access key $
{
md.accessKeyId}")
        }
    }
}

API 상세 내용은 AWS SDK for Kotlin API reference의 ListAccessKeys 문서를 참고하세요.

Tools for PowerShell V4

예시 1: 이 명령은 Bob IAM 사용자의 액세스 키를 나열해요. IAM 사용자의 비밀 액세스 키는 나열할 수 없다는 점을 참고하세요. 비밀 액세스 키를 잃어버렸다면 New-IAMAccessKey cmdlet으로 새 액세스 키를 만들어야 해요.

Get-IAMAccessKey -UserName "Bob"

출력:

AccessKeyId                CreateDate                   Status              UserName
-----------                ----------                   ------              --------
AKIAIOSFODNN7EXAMPLE       12/3/2014 10:53:41 AM        Active              Bob
AKIAI44QH8DHBEXAMPLE       6/6/2013 8:42:26 PM          Inactive            Bob

API 상세 내용은 AWS Tools for PowerShell Cmdlet Reference (V4)의 ListAccessKeys 문서를 참고하세요.

Tools for PowerShell V5

Get-IAMAccessKey -UserName "Bob"

출력:

AccessKeyId                CreateDate                   Status              UserName
-----------                ----------                   ------              --------
AKIAIOSFODNN7EXAMPLE       12/3/2014 10:53:41 AM        Active              Bob
AKIAI44QH8DHBEXAMPLE       6/6/2013 8:42:26 PM          Inactive            Bob

API 상세 내용은 AWS Tools for PowerShell Cmdlet Reference (V5)의 ListAccessKeys 문서를 참고하세요.

SDK for Python (Boto3)

def list_keys(user_name):
    """
    Lists the keys owned by the specified user.

    :param user_name: The name of the user.
    :return: The list of keys owned by the user.
    """
    try:
        keys = list(iam.User(user_name).access_keys.all())
        logger.info("Got %s access keys for %s.", len(keys), user_name)
    except ClientError:
        logger.exception("Couldn't get access keys for %s.", user_name)
        raise
    else:
        return keys

API 상세 내용은 AWS SDK for Python (Boto3) API Reference의 ListAccessKeys 문서를 참고하세요.

SDK for Ruby

이 예시 모듈은 액세스 키를 나열·생성·비활성화·삭제해요.

# Manages access keys for IAM users
class AccessKeyManager
  def initialize(iam_client, logger: Logger.new($stdout))
    @iam_client = iam_client
    @logger = logger
    @logger.progname = 'AccessKeyManager'
  end

  # Lists access keys for a user
  #
  # @param user_name [String] The name of the user.
  def list_access_keys(user_name)
    response = @iam_client.list_access_keys(user_name: user_name)
    if response.access_key_metadata.empty?
      @logger.info("No access keys found for user '#
{
user_name}'.")
    else
      response.access_key_metadata.map(&:access_key_id)
    end
  rescue Aws::IAM::Errors::NoSuchEntity
    @logger.error("Error listing access keys: cannot find user '#
{
user_name}'.")
    []
  rescue StandardError => e
    @logger.error("Error listing access keys: #
{
e.message}")
    []
  end

  # Creates an access key for a user
  #
  # @param user_name [String] The name of the user.
  # @return [Boolean]
  def create_access_key(user_name)
    response = @iam_client.create_access_key(user_name: user_name)
    access_key = response.access_key
    @logger.info("Access key created for user '#
{
user_name}': #
{
access_key.access_key_id}")
    access_key
  rescue Aws::IAM::Errors::LimitExceeded
    @logger.error('Error creating access key: limit exceeded. Cannot create more.')
    nil
  rescue StandardError => e
    @logger.error("Error creating access key: #
{
e.message}")
    nil
  end

  # Deactivates an access key
  #
  # @param user_name [String] The name of the user.
  # @param access_key_id [String] The ID for the access key.
  # @return [Boolean]
  def deactivate_access_key(user_name, access_key_id)
    @iam_client.update_access_key(
      user_name: user_name,
      access_key_id: access_key_id,
      status: 'Inactive'
    )
    true
  rescue StandardError => e
    @logger.error("Error deactivating access key: #
{
e.message}")
    false
  end

  # Deletes an access key
  #
  # @param user_name [String] The name of the user.
  # @param access_key_id [String] The ID for the access key.
  # @return [Boolean]
  def delete_access_key(user_name, access_key_id)
    @iam_client.delete_access_key(
      user_name: user_name,
      access_key_id: access_key_id
    )
    true
  rescue StandardError => e
    @logger.error("Error deleting access key: #
{
e.message}")
    false
  end
end

API 상세 내용은 AWS SDK for Ruby API Reference의 ListAccessKeys 문서를 참고하세요.

SDK for SAP ABAP

    TRY.
        oo_result = lo_iam->listaccesskeys(
          iv_username = iv_user_name ).
        MESSAGE 'Retrieved access key list.' TYPE 'I'.
      CATCH /aws1/cx_iamnosuchentityex.
        MESSAGE 'User does not exist.' TYPE 'E'.
    ENDTRY.

API 상세 내용은 AWS SDK for SAP ABAP API reference의 ListAccessKeys 문서를 참고하세요.

AWS SDK 또는 CLI로 ListAccessKeys 사용하기