Motivation

We need to migrate IAM user access keys from moto to LocalStack.

Changes

Operations Implemented

New Entity: AccessKeyEntity

@dataclasses.dataclass
class AccessKeyEntity:
    """Wrapper for AccessKey with last used tracking."""
    access_key: AccessKey  # UserName, AccessKeyId, Status, SecretAccessKey, CreateDate
    last_used: AccessKeyLastUsed | None = None

Extended UserEntity

Added access_keys field as a dict for efficient lookup by access key ID:

access_keys: dict[str, AccessKeyEntity] = field(default_factory=dict)  # access_key_id -> entity

Extended IamStore

Added ACCESS_KEY_INDEX for efficient cross-user access key lookups:

ACCESS_KEY_INDEX: dict[str, str] = CrossRegionAttribute(default=dict)  # access_key_id -> user_name

Design Decisions

1. Access Key ID Generation

• Uses generate_iam_identifier() from utils.py (same as role/user IDs)
• Prefix determined by config.PARITY_AWS_ACCESS_KEY_ID:
  • AKIA for AWS parity mode
  • LKIA for LocalStack default
• Total length: 20 characters

2. Secret Access Key Generation

• 40-character random string
• Character set: string.ascii_letters + string.digits + "+/"

3. User Name Derivation (Self-Referential Operations)

When user_name is not provided, the implementation:

1. First tries to look up the access key ID from the request's Authorization header in ACCESS_KEY_INDEX
2. If found, returns the associated user name directly
3. If not found, raises ValidationError("Must specify userName when calling with non-User credentials")

This approach allows users to manage their own access keys without specifying their username.

4. Access Key Limit

• Maximum 2 access keys per user (AWS behavior)
• Enforced via LIMIT_ACCESS_KEYS_PER_USER = 2 constant
• Raises LimitExceededException when exceeded

5. Delete User Validation

Updated delete_user to check for access keys before deletion:

• Raises DeleteConflictException("Cannot delete entity, must delete access keys first.") if user has access keys

6. Error Handling

• get_access_key_last_used with nonexistent key returns AccessDenied (not NoSuchEntity) to prevent enumeration attacks - this matches AWS behavior

Thread Safety

All access key operations use the existing self._user_lock for thread safety.

Known Limitations

1. LastUsedDate Tracking: The last_used field is not populated because tracking when access keys are actually used requires integration with the authentication/STS layer. This is marked for future work.

Tests

Related