Declaring an IAM Access Key Resource by CloudFormation

Question

I created a user in my template with an access key:

"MyAccessKey" : {
   "Type" : "AWS::IAM::AccessKey",
   "Properties" : {
      "UserName" : { "Ref" : "User12" }
   }
} 

I need to get the access key ID and the secret key in the output of the template. How to do that ? Thank you

Zeidman

Answer 1

The access key id and the secret key are available as return values for the AWS::IAM::AccessKey resource:

"Outputs" : {
  "MyAccessKeyId": {
    "Ref" : "MyAccessKey"
  },
  "MySecretKey": {
    "Fn::GetAtt": [ "MyAccessKey", "SecretAccessKey" ]
  }
}

Manaker

Unfortunately it seems that there's no way to hide this from the logs once you have got the key. It would be nice if they had an output flag that said that it was just a temporary output that you wanted to disappear afterwards – Parra

If you want to hide this from logs you can create a custom resource and encrypt the key using KMS docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/… – Sherysherye

Or, instead of exposing the values via Outputs, you could put the values to a AWS::SecretsManager::Secret. – Washerman

How do you do that @RHBecker, is there any good example or doc on doing so? Ta PS: found this binx.io/blog/2017/09/22/… – Alopecia

@Alopecia I posted a new answer to exhibit how I've used the AWS::SecretsManager::Secret to this end. – Washerman

It's really annoying that they seem to face you into using their Secrets namaging service. I just need a one-time access to this information, plugin it in the secret manager of my CI/CD tool and that's it. – Subreption

Answer 2

CloudFormation's Outputs documentation states ...

CloudFormation doesn't redact or obfuscate any information you include in the Outputs section. We strongly recommend you don't use this section to output sensitive information, such as passwords or secrets.

A safer option is to create an AWS::SecretsManager::Secret resource that contains the user's access and secret keys.

Here's an example of a template for creating "bot" users that leverages this approach ...

---
AWSTemplateFormatVersion: 2010-09-09
Description: example bot user

Resources:

  Bot:
    Type: AWS::IAM::User
    Properties:
      Path: /bot/
      UserName: !Ref AWS::StackName

  BotCredentials:
    Type: AWS::IAM::AccessKey
    Properties:
      Status: Active
      UserName: !Ref Bot

  BotCredentialsStored:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub /bot/credentials/${Bot}
      SecretString: !Sub '{"ACCESS_KEY":"${BotCredentials}","SECRET_KEY":"${BotCredentials.SecretAccessKey}"}'

Washerman

How is a user supposed to then get the secret key from the Secrets Manager? – Burgener

@MrPablo If the user has sufficient IAM privileges, the value can be retrieved via the Secrets service console, or via CLI, using the get-secret-value command. – Washerman