Rotating AWS access keys is an important part of an overall security strategy. Ansible can help us manage this process. In this exercise, we will see how to work with AWS IAM user keys using Ansible.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Create `/home/ansible/keyUpdate.yml` and Add an Ansible Play that Removes the Old Access Keys for the IAM User `testuser` and Creates a New Set, Stored in `/home/ansible/newkey.txt`
After logging into the EC2 instance, run
su - ansibleto become theansibleuser. The password is the same as it is forcloud_user.Create the playbook and edit it such that it resembles the following:
- hosts: localhost gather_facts: no vars_files: - keys.yml tasks: - name: Get access key iam: aws_access_key: "{{ AWS_ACCESS_KEY_ID }}" aws_secret_key: "{{ AWS_SECRET_ACCESS_KEY }}" region: "{{ AWS_REGION}}" iam_type: user name: testuser state: present register: iam_info - name: Remove original key iam: aws_access_key: "{{ AWS_ACCESS_KEY_ID }}" aws_secret_key: "{{ AWS_SECRET_ACCESS_KEY }}" region: "{{ AWS_REGION}}" iam_type: user name: testuser state: update access_key_ids: "{{ iam_info.user_meta.access_keys[0].access_key_id }}" access_key_state: remove - name: Create new key iam: aws_access_key: "{{ AWS_ACCESS_KEY_ID }}" aws_secret_key: "{{ AWS_SECRET_ACCESS_KEY }}" region: "{{ AWS_REGION}}" iam_type: user name: testuser state: update access_key_state: create register: new_key - name: Store new access key information lineinfile: create: yes path: /home/ansible/newkey.txt mode: 0600 line: "{{ new_key.created_keys[0].access_key_id }}" - name: Store new secret key information lineinfile: path: /home/ansible/newkey.txt line: "{{ new_key.created_keys[0].secret_access_key }}"
- Run the `/home/ansible/keyUpdate.yml` Playbook to Perform the Required Tasks
- Run the following command:
ansible-playbook /home/ansible/keyUpdate.yml
- Run the following command:
