AWS SDK로 IAM 액세스 키 관리하기
AWS SDK로 IAM 액세스 키 관리하기
이 코드 예제에서는 AWS SDK를 사용해 IAM 액세스 키를 관리하는 방법을 보여드려요. 다음 작업을 수행할 수 있어요.
출처: 문서
본문
이 예제는 다음과 같은 작업들을 다루어요.
- 액세스 키 생성 및 목록 조회
- 액세스 키가 마지막으로 언제 어떻게 사용됐는지 확인
- 액세스 키 업데이트 및 삭제
Warning 보안 위험을 피하기 위해, 목적 지향 소프트웨어를 개발하거나 실제 데이터를 다룰 때는 인증에 IAM 사용자를 사용하지 마세요. 대신 AWS IAM Identity Center 같은 자격 증명 공급자와의 페더레이션(federation)을 사용해요.
Python (SDK for Python / Boto3)
Note GitHub에 더 많은 내용이 있어요. AWS Code Examples Repository에서 전체 예제와 설정·실행 방법을 확인할 수 있어요.
IAM 액세스 키 동작을 감싸는 래퍼 함수들을 만들어요.
import logging
import boto3
from botocore.exceptions import ClientError
logger = logging.getLogger(__name__)
iam = boto3.resource("iam")
def list_keys(user_name):
"""
Lists the keys owned by the specified user.
:param user_name: The name of the user.
:return: The list of keys owned by the user.
"""
try:
keys = list(iam.User(user_name).access_keys.all())
logger.info("Got %s access keys for %s.", len(keys), user_name)
except ClientError:
logger.exception("Couldn't get access keys for %s.", user_name)
raise
else:
return keys
def create_key(user_name):
"""
Creates an access key for the specified user. Each user can have a
maximum of two keys.
:param user_name: The name of the user.
:return: The created access key.
"""
try:
key_pair = iam.User(user_name).create_access_key_pair()
logger.info(
"Created access key pair for %s. Key ID is %s.",
key_pair.user_name,
key_pair.id,
)
except ClientError:
logger.exception("Couldn't create access key pair for %s.", user_name)
raise
else:
return key_pair
def get_last_use(key_id):
"""
Gets information about when and how a key was last used.
:param key_id: The ID of the key to look up.
:return: Information about the key's last use.
"""
try:
response = iam.meta.client.get_access_key_last_used(AccessKeyId=key_id)
last_used_date = response["AccessKeyLastUsed"].get("LastUsedDate", None)
last_service = response["AccessKeyLastUsed"].get("ServiceName", None)
logger.info(
"Key %s was last used by %s on %s to access %s.",
key_id,
response["UserName"],
last_used_date,
last_service,
)
except ClientError:
logger.exception("Couldn't get last use of key %s.", key_id)
raise
else:
return response
def update_key(user_name, key_id, activate):
"""
Updates the status of a key.
:param user_name: The user that owns the key.
:param key_id: The ID of the key to update.
:param activate: When True, the key is activated. Otherwise, the key is deactivated.
"""
try:
key = iam.User(user_name).AccessKey(key_id)
if activate:
key.activate()
else:
key.deactivate()
logger.info("%s key %s.", "Activated" if activate else "Deactivated", key_id)
except ClientError:
logger.exception(
"Couldn't %s key %s.", "Activate" if activate else "Deactivate", key_id
)
raise
def delete_key(user_name, key_id):
"""
Deletes a user's access key.
:param user_name: The user that owns the key.
:param key_id: The ID of the key to delete.
"""
try:
key = iam.AccessKey(user_name, key_id)
key.delete()
logger.info("Deleted access key %s for %s.", key.id, key.user_name)
except ClientError:
logger.exception("Couldn't delete key %s for %s", key_id, user_name)
raise
래퍼 함수들을 사용해 현재 사용자에 대해 액세스 키 동작을 수행해요.
def usage_demo():
"""Shows how to create and manage access keys."""
def print_keys():
"""Gets and prints the current keys for a user."""
current_keys = list_keys(current_user_name)
print("The current user's keys are now:")
print(*[f"{key.id}: {key.status}" for key in current_keys], sep="\n")
logging.basicConfig(level=logging.INFO, format="%(levelname)s: %(message)s")
print("-" * 88)
print("Welcome to the AWS Identity and Account Management access key demo.")
print("-" * 88)
current_user_name = iam.CurrentUser().user_name
print(
f"This demo creates an access key for the current user "
f"({current_user_name}), manipulates the key in a few ways, and then "
f"deletes it."
)
all_keys = list_keys(current_user_name)
if len(all_keys) == 2:
print(
"The current user already has the maximum of 2 access keys. To run "
"this demo, either delete one of the access keys or use a user "
"that has only 1 access key."
)
else:
new_key = create_key(current_user_name)
print(f"Created a new key with id {new_key.id} and secret {new_key.secret}.")
print_keys()
existing_key = next(key for key in all_keys if key != new_key)
last_use = get_last_use(existing_key.id)["AccessKeyLastUsed"]
print(
f"Key {all_keys[0].id} was last used to access {last_use['ServiceName']} "
f"on {last_use['LastUsedDate']}"
)
update_key(current_user_name, new_key.id, False)
print(f"Key {new_key.id} is now deactivated.")
print_keys()
delete_key(current_user_name, new_key.id)
print_keys()
print("Thanks for watching!")
API 상세는 AWS SDK for Python (Boto3) API Reference의 다음 항목을 참고해요.
CreateAccessKeyDeleteAccessKeyGetAccessKeyLastUsedListAccessKeysUpdateAccessKey