Find IAM SSH Public Keys and Service-Specific Credentials

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListUsers",
      "Effect": "Allow",
      "Action": "iam:ListUsers",
      "Resource": "*"
    },
    {
      "Sid": "ReadUserCredentials",
      "Effect": "Allow",
      "Action": [
        "iam:ListSSHPublicKeys",
        "iam:ListServiceSpecificCredentials",
        "iam:ListSigningCertificates"
      ],
      "Resource": "arn:aws:iam::111122223333:user/*"
    },
    {
      "Sid": "DeactivateOrDeleteWithApply",
      "Effect": "Allow",
      "Action": [
        "iam:UpdateSSHPublicKey",
        "iam:DeleteSSHPublicKey",
        "iam:UpdateServiceSpecificCredential",
        "iam:DeleteServiceSpecificCredential",
        "iam:UpdateSigningCertificate",
        "iam:DeleteSigningCertificate"
      ],
      "Resource": "arn:aws:iam::111122223333:user/*"
    }
  ]
}

// find-iam-users-with-ssh-keys-and-service-credentials.ts
// Lists the long-lived IAM user credentials that access key audits miss: SSH public keys (CodeCommit),
// service-specific credentials (Git credentials, Amazon Keyspaces passwords, API keys) and X.509 signing
// certificates, with age and status. Report only unless you pass --apply with --user: then it sets
// that user's active credentials of these types to Inactive, and with --delete-inactive it deletes the
// ones that are already Inactive.
// Usage:
//   npx tsx find-iam-users-with-ssh-keys-and-service-credentials.ts [--max-age-days 90]
//   npx tsx find-iam-users-with-ssh-keys-and-service-credentials.ts --user build-bot --apply
//   npx tsx find-iam-users-with-ssh-keys-and-service-credentials.ts --user build-bot --apply --delete-inactive
import {
  DeleteSSHPublicKeyCommand,
  DeleteServiceSpecificCredentialCommand,
  DeleteSigningCertificateCommand,
  IAMClient,
  ListServiceSpecificCredentialsCommand,
  UpdateSSHPublicKeyCommand,
  UpdateServiceSpecificCredentialCommand,
  UpdateSigningCertificateCommand,
  paginateListSSHPublicKeys,
  paginateListSigningCertificates,
  paginateListUsers,
  type ServiceSpecificCredentialMetadata,
} from "@aws-sdk/client-iam";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const maxAgeDays = Number(flag("--max-age-days") ?? "90");
const targetUser = flag("--user");
const apply = args.includes("--apply");
const deleteInactive = args.includes("--delete-inactive");
const iam = new IAMClient({ region: process.env.AWS_REGION ?? "us-east-1" });

type Kind = "ssh-key" | "service-credential" | "signing-cert";
interface Cred {
  User: string;
  Kind: Kind;
  Service: string;
  Id: string;
  Status: string;
  Created: string;
  AgeDays: number;
  Expires: string;
  Action: string;
}

const day = (d: Date | undefined) => (d ? d.toISOString().slice(0, 10) : "-");
const ageOf = (d: Date | undefined) => (d ? Math.floor((Date.now() - d.getTime()) / 86_400_000) : 0);

// ListServiceSpecificCredentials has no paginator in the SDK, so follow Marker by hand.
async function serviceCreds(userName: string): Promise<ServiceSpecificCredentialMetadata[]> {
  const out: ServiceSpecificCredentialMetadata[] = [];
  let marker: string | undefined;
  do {
    const res = await iam.send(new ListServiceSpecificCredentialsCommand({ UserName: userName, Marker: marker }));
    out.push(...(res.ServiceSpecificCredentials ?? []));
    marker = res.IsTruncated ? res.Marker : undefined;
  } while (marker);
  return out;
}

function action(status: string, created: Date | undefined, expires?: Date): string {
  if (status !== "Active") return "inactive: delete when confirmed";
  if (expires && expires.getTime() < Date.now()) return "expired: delete";
  return ageOf(created) > maxAgeDays ? `older than ${maxAgeDays} days: rotate or remove` : "recent";
}

async function credsFor(userName: string): Promise<Cred[]> {
  const out: Cred[] = [];
  for await (const page of paginateListSSHPublicKeys({ client: iam }, { UserName: userName })) {
    for (const k of page.SSHPublicKeys ?? []) {
      out.push({ User: userName, Kind: "ssh-key", Service: "CodeCommit", Id: k.SSHPublicKeyId ?? "", Status: k.Status ?? "", Created: day(k.UploadDate), AgeDays: ageOf(k.UploadDate), Expires: "-", Action: action(k.Status ?? "", k.UploadDate) });
    }
  }
  for (const c of await serviceCreds(userName)) {
    out.push({ User: userName, Kind: "service-credential", Service: c.ServiceName ?? "", Id: c.ServiceSpecificCredentialId ?? "", Status: c.Status ?? "", Created: day(c.CreateDate), AgeDays: ageOf(c.CreateDate), Expires: day(c.ExpirationDate), Action: action(c.Status ?? "", c.CreateDate, c.ExpirationDate) });
  }
  for await (const page of paginateListSigningCertificates({ client: iam }, { UserName: userName })) {
    for (const c of page.Certificates ?? []) {
      out.push({ User: userName, Kind: "signing-cert", Service: "X.509", Id: c.CertificateId ?? "", Status: c.Status ?? "", Created: day(c.UploadDate), AgeDays: ageOf(c.UploadDate), Expires: "-", Action: action(c.Status ?? "", c.UploadDate) });
    }
  }
  return out;
}

async function deactivateOrDelete(c: Cred): Promise<string> {
  const UserName = c.User;
  if (c.Status === "Active") {
    if (c.Kind === "ssh-key") await iam.send(new UpdateSSHPublicKeyCommand({ UserName, SSHPublicKeyId: c.Id, Status: "Inactive" }));
    if (c.Kind === "service-credential") await iam.send(new UpdateServiceSpecificCredentialCommand({ UserName, ServiceSpecificCredentialId: c.Id, Status: "Inactive" }));
    if (c.Kind === "signing-cert") await iam.send(new UpdateSigningCertificateCommand({ UserName, CertificateId: c.Id, Status: "Inactive" }));
    return "set to Inactive";
  }
  if (!deleteInactive) return c.Action;
  if (c.Kind === "ssh-key") await iam.send(new DeleteSSHPublicKeyCommand({ UserName, SSHPublicKeyId: c.Id }));
  if (c.Kind === "service-credential") await iam.send(new DeleteServiceSpecificCredentialCommand({ UserName, ServiceSpecificCredentialId: c.Id }));
  if (c.Kind === "signing-cert") await iam.send(new DeleteSigningCertificateCommand({ UserName, CertificateId: c.Id }));
  return "deleted";
}

async function main(): Promise<void> {
  if (apply && !targetUser) {
    console.error("--apply needs --user with the IAM user name to change.");
    process.exit(1);
  }
  const creds: Cred[] = [];
  let users = 0;
  for await (const page of paginateListUsers({ client: iam }, {})) {
    for (const u of page.Users ?? []) {
      if (!u.UserName) continue;
      users++;
      creds.push(...(await credsFor(u.UserName)));
    }
  }

  if (apply && targetUser) {
    for (const c of creds.filter((x) => x.User === targetUser)) {
      try {
        c.Action = await deactivateOrDelete(c);
      } catch (err) {
        c.Action = `error: ${err instanceof Error ? err.name : String(err)}`;
      }
    }
  }

  const active = creds.filter((c) => c.Status === "Active").length;
  console.log(`IAM users: ${users}; SSH keys, service-specific credentials and signing certificates: ${creds.length} (${active} active)`);
  creds.sort((a, b) => b.AgeDays - a.AgeDays);
  if (creds.length) console.table(creds);
  if (!apply) console.log("Report only. Pass --user and --apply to deactivate one user's credentials.");
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-iam
npm install --save-dev tsx typescript @types/node

# Report for the whole account
AWS_PROFILE=readonly npx tsx find-iam-users-with-ssh-keys-and-service-credentials.ts

# Deactivate one user's active SSH keys, service-specific credentials and signing certificates
AWS_PROFILE=iam-admin npx tsx find-iam-users-with-ssh-keys-and-service-credentials.ts --user build-bot --apply

# A week later, delete the ones that are now inactive
AWS_PROFILE=iam-admin npx tsx find-iam-users-with-ssh-keys-and-service-credentials.ts --user build-bot --apply --delete-inactive

IAM users: 2; SSH keys, service-specific credentials and signing certificates: 5 (4 active)
┌─────────┬─────────────┬──────────────────────┬────────────────────────────┬────────────────┬────────────┬──────────────┬─────────┬──────────────┬────────────────────────────────────────┐
│ (index) │ User        │ Kind                 │ Service                    │ Id             │ Status     │ Created      │ AgeDays │ Expires      │ Action                                 │
├─────────┼─────────────┼──────────────────────┼────────────────────────────┼────────────────┼────────────┼──────────────┼─────────┼──────────────┼────────────────────────────────────────┤
│ 0       │ 'build-bot' │ 'signing-cert'       │ 'X.509'                    │ 'CERTEXAMPLE'  │ 'Active'   │ '2021-04-08' │ 2000    │ '-'          │ 'older than 90 days: rotate or remove' │
│ 1       │ 'build-bot' │ 'ssh-key'            │ 'CodeCommit'               │ 'APKAEXAMPLE2' │ 'Inactive' │ '2024-04-12' │ 900     │ '-'          │ 'inactive: delete when confirmed'      │
│ 2       │ 'build-bot' │ 'ssh-key'            │ 'CodeCommit'               │ 'APKAEXAMPLE1' │ 'Active'   │ '2024-07-09' │ 812     │ '-'          │ 'older than 90 days: rotate or remove' │
│ 3       │ 'build-bot' │ 'service-credential' │ 'codecommit.amazonaws.com' │ 'ACCAEXAMPLE1' │ 'Active'   │ '2024-12-28' │ 640     │ '-'          │ 'older than 90 days: rotate or remove' │
│ 4       │ 'alice'     │ 'service-credential' │ 'bedrock.amazonaws.com'    │ 'ACCAEXAMPLE2' │ 'Active'   │ '2026-09-17' │ 12      │ '2026-10-17' │ 'recent'                               │
└─────────┴─────────────┴──────────────────────┴────────────────────────────┴────────────────┴────────────┴──────────────┴─────────┴──────────────┴────────────────────────────────────────┘
Report only. Pass --user and --apply to deactivate one user's credentials.