Skip to content

Instantly share code, notes, and snippets.

@mafonso
Last active October 10, 2023 05:19
Show Gist options
  • Save mafonso/7ee51981581f544ed52c to your computer and use it in GitHub Desktop.
Save mafonso/7ee51981581f544ed52c to your computer and use it in GitHub Desktop.
List Access Keys for all IAM users
for user in $(aws iam list-users --output text --no-cli-pager | awk '{print $NF}'); do
aws iam list-access-keys --user $user --output text --no-cli-pager
test $? -gt 128 && exit
done
for user in $(aws iam list-users --output text --no-cli-pager| awk '{print $NF}'); do aws iam list-access-keys --user $user --output json --no-cli-pager; done | jq
@emyller
Copy link

emyller commented Jan 5, 2023

Very handy, thank you!

@chaseconey
Copy link

You can add --no-cli-pager to the end if you want to get all the output inline.

@RAJNISH3
Copy link

I want to copy all the keys to a JSON file, how could I achieve this here?

@jars
Copy link

jars commented Apr 11, 2023

FYI if you have access, the same information (and more) is accessible in IAM Console -> Credential Report.

@ceejayoz
Copy link

ceejayoz commented Aug 14, 2023

@jars I've got full admin roles and I don't get the actual key IDs in the resulting CSV. I get all the active / last used sort of stuff, but not the IDs.

@jars
Copy link

jars commented Aug 14, 2023

You're right @ceejayoz , thanks for pointing that out. At the most, the credential report can offer some access key metadata. Folks might be able to use this to reduce calls to the aws iam list-access-keys endpoint.

@work-bw
Copy link

work-bw commented Sep 13, 2023

I modified your command a bit to run in cloudshell in case it helps anyone.

for user in $(aws iam list-users --output text | awk '{print $NF}'); do aws iam list-access-keys --user $user --output text; done

@mafonso
Copy link
Author

mafonso commented Sep 14, 2023

Thank you all. I didn't realize until now that this little thing was getting this visibility.
Some good suggestions up there that I took up in the updated version.

Also added a one-liner and JSON version more suitable to pipe into jq

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment