Skip to content
check-circle

GitHub Action

Rotate AWS Access Keys

v1.3.0 Latest version

Rotate AWS Access Keys

check-circle

Rotate AWS Access Keys

Github action that rotates the iam user tokens on a schedule

Installation

Copy and paste the following snippet into your .yml file.

 
              
- name: Rotate AWS Access Keys

              
  uses: kneemaa/[email protected]
Learn more about this action in kneemaa/github-action-rotate-aws-secrets

Choose a version

Validate Master CodeQL

Rotate AWS Access token stored in Github Repository secrets

Performs the following actions:

  1. Checks for existing IAM access and secret key pairs of the provided IAM user (IAM_USERNAME)
  2. If 2 sets of keys exists, the action will fail
  3. If 0 or 1 set of keys exists, the action will:
    1. Create a new key pair for the IAM user
    2. Update the Github secrets (GITHUB_ACCESS_KEY_NAME and GITHUB_SECRET_KEY_NAME) for all provided repositories (OWNER_REPOSITORY)
    3. Delete the original key pair from the IAM user (if 1 already exists)

Environment Variables

Variable Required Description Default
AWS_ACCESS_KEY_ID True Access Key ID to authenticate with AWS. You can use ${{secrets.ACCESS_KEY_ID}} N/A
AWS_SECRET_ACCESS_KEY True Secret Access Key ID to authenticate with AWS. You can use ${{secrets.SECRET_ACCESS_KEY_ID}} N/A
AWS_SESSION_TOKEN False Session Token for the current AWS session. Only required if you assume a role first. N/A
IAM_USERNAME False Name of IAM user being rotated, if not set the username which is used in the AWS credentials is used N/A
PERSONAL_ACCESS_TOKEN True Github Token with Repo Admin access of the target repo. As of 4/16/2020 ${{github.token}} does not have permission to query the Secrets API. The existing env var GITHUB_TOKEN which is added automatically to all runs does not have the access secrets. N/A
OWNER_REPOSITORY True The owner and repository name. For example, octocat/Hello-World. If being ran in the repo being updated, you can use ${{github.repository}}. Multiple repositories can be specified by a comma-separated list (e.g. OWNER_REPOSITORY: ${{ github.repository }},MyGitHubOrgOrUser/MyGitHubRepo). N/A
GITHUB_ACCESS_KEY_NAME False Name of the secret for the Access Key ID. Setting this overrides the default. access_key_id
GITHUB_SECRET_KEY_NAME False Name of the secret for the Secret Access Key ID. Setting this overrides the default. secret_key_id
GITHUB_ENVIRONMENT False Name of the Github environment where the secrets are stored. N/A

Example

Rotation every monday at 13:27 UTC

on:
  schedule:
    - cron: '27 13 * * 1' 

jobs:
  rotate:
    name: rotate iam user keys
    runs-on: ubuntu-latest
    steps:
      - uses: actions/[email protected]

      - name: rotate aws keys
        uses: kneemaa/[email protected]
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.access_key_name }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.secret_key_name }}
          IAM_USERNAME: 'iam-user-name'
          PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
          OWNER_REPOSITORY: ${{ github.repository }}

Rotation every monday at 13:27 UTC for the dev Github environment secret

on:
  schedule:
    - cron: '27 13 * * 1' 

jobs:
  rotate:
    name: rotate iam user keys
    runs-on: ubuntu-latest
    environment: dev
    steps:
      - uses: actions/[email protected]

      - name: rotate aws keys
        uses: kneemaa/[email protected]
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.access_key_name }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.secret_key_name }}
          IAM_USERNAME: 'iam-user-name'
          PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
          OWNER_REPOSITORY: ${{ github.repository }}
          GITHUB_ENVIRONMENT: dev

Note that environment names must be set twice:

  • at the job level for Github workflow to know where to fetch the secrets
  • in the action's environment variable so that the action knows where to store the secret back

Adding Slack notification on failure only

on:
  schedule:
    - cron: '27 13 * * 1'

jobs:
  rotate:
    name: rotate iam user keys
    runs-on: ubuntu-latest
    steps:
      - uses: actions/[email protected]

      - name: rotate aws keys
        uses: kneemaa/[email protected]
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.access_key_name }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.secret_key_name }}
          IAM_USERNAME: 'iam-user-name'
          PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
          OWNER_REPOSITORY: ${{ github.repository }}

      - name: Send Slack Status
        if: failure()
        uses: 8398a7/[email protected]
        with:
          status: ${{job.status}}
          author_name: kneemaa-aws-rotation-action
          username: kneemaa-rotation-bot
          text: Rotating the token had a status of ${{ job.status }}
          channel: alerts-test
        env:
          SLACK_WEBHOOK_URL: https://hooks.slack.com/services/.../...

License

The Dockerfile and associated scripts and documentation in this project are released under the MIT License.