Manage IAM access keys
Create an access key
To create an IAM access key, call the IamClient’s
createAccessKey
method with a CreateAccessKeyRequest
Note
You must set the region to AWS_GLOBAL for
IamClient
calls to work because IAM is a global
service.
Imports
import software.amazon.awssdk.services.iam.model.CreateAccessKeyRequest; import software.amazon.awssdk.services.iam.model.CreateAccessKeyResponse; import software.amazon.awssdk.regions.Region; import software.amazon.awssdk.services.iam.IamClient; import software.amazon.awssdk.services.iam.model.IamException;
Code
public static String createIAMAccessKey(IamClient iam,String user) { try { CreateAccessKeyRequest request = CreateAccessKeyRequest.builder() .userName(user).build(); CreateAccessKeyResponse response = iam.createAccessKey(request); String keyId = response.accessKey().accessKeyId(); return keyId; } catch (IamException e) { System.err.println(e.awsErrorDetails().errorMessage()); System.exit(1); } return ""; }
See the complete example
List access keys
To list the access keys for a given user, create a ListAccessKeysRequest
IamClient’s
listAccessKeys
method.
Note
If you do not supply a user name to listAccessKeys
, it will attempt to list access keys
associated with the Amazon Web Services account that signed the request.
Imports
import software.amazon.awssdk.services.iam.model.AccessKeyMetadata; import software.amazon.awssdk.services.iam.model.IamException; import software.amazon.awssdk.services.iam.model.ListAccessKeysRequest; import software.amazon.awssdk.services.iam.model.ListAccessKeysResponse; import software.amazon.awssdk.regions.Region; import software.amazon.awssdk.services.iam.IamClient;
Code
public static void listKeys( IamClient iam,String userName ){ try { boolean done = false; String newMarker = null; while (!done) { ListAccessKeysResponse response; if(newMarker == null) { ListAccessKeysRequest request = ListAccessKeysRequest.builder() .userName(userName).build(); response = iam.listAccessKeys(request); } else { ListAccessKeysRequest request = ListAccessKeysRequest.builder() .userName(userName) .marker(newMarker).build(); response = iam.listAccessKeys(request); } for (AccessKeyMetadata metadata : response.accessKeyMetadata()) { System.out.format("Retrieved access key %s", metadata.accessKeyId()); } if (!response.isTruncated()) { done = true; } else { newMarker = response.marker(); } } } catch (IamException e) { System.err.println(e.awsErrorDetails().errorMessage()); System.exit(1); } }
The results of listAccessKeys
are paged (with a default maximum of 100
records per call). You can call isTruncated
on the returned ListAccessKeysResponse
marker
on the
ListAccessKeysResponse
and use it when creating a new request. Use that
new request in the next invocation of listAccessKeys
.
See the complete example
Retrieve an access key’s last used time
To get the time an access key was last used, call the IamClient’s
getAccessKeyLastUsed
method with the access key’s ID (which can be passed
in using a GetAccessKeyLastUsedRequest
You can then use the returned GetAccessKeyLastUsedResponse
Imports
import software.amazon.awssdk.regions.Region; import software.amazon.awssdk.services.iam.IamClient; import software.amazon.awssdk.services.iam.model.GetAccessKeyLastUsedRequest; import software.amazon.awssdk.services.iam.model.GetAccessKeyLastUsedResponse; import software.amazon.awssdk.services.iam.model.IamException;
Code
public static void getAccessKeyLastUsed(IamClient iam, String accessId ){ try { GetAccessKeyLastUsedRequest request = GetAccessKeyLastUsedRequest.builder() .accessKeyId(accessId).build(); GetAccessKeyLastUsedResponse response = iam.getAccessKeyLastUsed(request); System.out.println("Access key was last used at: " + response.accessKeyLastUsed().lastUsedDate()); } catch (IamException e) { System.err.println(e.awsErrorDetails().errorMessage()); System.exit(1); } System.out.println("Done"); }
See the complete example
Activate or deactivate access keys
You can activate or deactivate an access key by creating an UpdateAccessKeyRequest
status
IamClient’s
updateAccessKey
method.
Imports
import software.amazon.awssdk.services.iam.model.IamException; import software.amazon.awssdk.services.iam.model.StatusType; import software.amazon.awssdk.services.iam.model.UpdateAccessKeyRequest; import software.amazon.awssdk.regions.Region; import software.amazon.awssdk.services.iam.IamClient;
Code
public static void updateKey(IamClient iam, String username, String accessId, String status ) { try { if (status.toLowerCase().equalsIgnoreCase("active")) { statusType = StatusType.ACTIVE; } else if (status.toLowerCase().equalsIgnoreCase("inactive")) { statusType = StatusType.INACTIVE; } else { statusType = StatusType.UNKNOWN_TO_SDK_VERSION; } UpdateAccessKeyRequest request = UpdateAccessKeyRequest.builder() .accessKeyId(accessId) .userName(username) .status(statusType) .build(); iam.updateAccessKey(request); System.out.printf( "Successfully updated the status of access key %s to" + "status %s for user %s", accessId, status, username); } catch (IamException e) { System.err.println(e.awsErrorDetails().errorMessage()); System.exit(1); } }
See the complete example
Delete an access key
To permanently delete an access key, call the IamClient’s
deleteKey
method, providing it with a DeleteAccessKeyRequest
Note
Once deleted, a key can no longer be retrieved or used. To temporarily deactivate a key so that it can be activated again later, use updateAccessKey method instead.
Imports
import software.amazon.awssdk.regions.Region; import software.amazon.awssdk.services.iam.IamClient; import software.amazon.awssdk.services.iam.model.DeleteAccessKeyRequest; import software.amazon.awssdk.services.iam.model.IamException;
Code
public static void deleteKey(IamClient iam ,String username, String accessKey ) { try { DeleteAccessKeyRequest request = DeleteAccessKeyRequest.builder() .accessKeyId(accessKey) .userName(username) .build(); iam.deleteAccessKey(request); System.out.println("Successfully deleted access key " + accessKey + " from user " + username); } catch (IamException e) { System.err.println(e.awsErrorDetails().errorMessage()); System.exit(1); } }
See the complete example
More information
-
CreateAccessKey in the IAM API Reference
-
ListAccessKeys in the IAM API Reference
-
GetAccessKeyLastUsed in the IAM API Reference
-
UpdateAccessKey in the IAM API Reference
-
DeleteAccessKey in the IAM API Reference