[bug report] [IAM] you can create more than 2 access keys per user

Question

I actually found this by accident while trying some simple terraform code (the one below was used to reproduce the bug):
```
locals {
  profile = "your_profile_name"
  to_delete = [for key in try(data.aws_iam_access_keys.test.access_keys, null) :
    format("aws iam delete-access-key --user-name %s --access-key-id %s --profile %s", aws_iam_user.test.id, key.access_key_id, local.profile)
  ]
  key_count = 20
}

variable "force" {
  type    = bool
  default = false
}

output "cli_delete" {
  value = join("
", local.to_delete)
}

data "aws_iam_access_keys" "test" {
  user = aws_iam_user.test.id
  depends_on = [
    aws_iam_access_key.init
  ]
}

resource "aws_iam_user" "test" {
  name = "test"
}

// initial 2 keys
resource "aws_iam_access_key" "init" {
  count = 2
  user  = aws_iam_user.test.id
}

// attempt to create multiple keys
resource "aws_iam_access_key" "extra" {
  count = var.force ? local.key_count : 0
  user  = aws_iam_user.test.id
}
```
**Terraform**
```
Terraform v1.9.7
on darwin_arm64
+ provider registry.terraform.io/hashicorp/aws v5.70.0
```
**Steps:**
- `terraform plan -out plan.out`

- `terraform apply plan.out`
   - you now have a user with 2 access keys

- **execute the two `aws iam delete-access-key` commands in the output**

- `export TF_VAR_force=true`

- `terraform plan -out plan.out`

- `terraform apply plan.out`

At this point you should have more than 2 keys (I could create 11) but usually you end up with 8. 
I tested one of the extra keys and it was valid.

swapzero · Answer

And here's a more successful attempt (incomplete screenshot):

![Enter image description here](/media/postImages/original/IMRaczstkuTCyyRs4HHifkyw)

aws cli:
```
{
    "AccessKeyMetadata": [
        {
            "UserName": "test",
            "AccessKeyId": "AKIAZZD4VWBS7ZHOW3EI",
            "Status": "Active",
            "CreateDate": "2024-10-15T18:08:34+00:00"
        },
        {
            "UserName": "test",
            "AccessKeyId": "AKIAZZD4VWBS5G57PZWC",
            "Status": "Active",
            "CreateDate": "2024-10-15T18:08:34+00:00"
        },
        {
            "UserName": "test",
            "AccessKeyId": "AKIAZZD4VWBSWCM3FQNM",
            "Status": "Active",
            "CreateDate": "2024-10-15T18:08:34+00:00"
        },
        {
            "UserName": "test",
            "AccessKeyId": "AKIAZZD4VWBS3SKGTOGX",
            "Status": "Active",
            "CreateDate": "2024-10-15T18:08:34+00:00"
        },
        {
            "UserName": "test",
            "AccessKeyId": "AKIAZZD4VWBSSZEFXDOJ",
            "Status": "Active",
            "CreateDate": "2024-10-15T18:08:34+00:00"
        },
        {
            "UserName": "test",
            "AccessKeyId": "AKIAZZD4VWBS6KCEFAV5",
            "Status": "Active",
            "CreateDate": "2024-10-15T18:08:34+00:00"
        },
        {
            "UserName": "test",
            "AccessKeyId": "AKIAZZD4VWBS364DKLWZ",
            "Status": "Active",
            "CreateDate": "2024-10-15T18:08:34+00:00"
        },
        {
            "UserName": "test",
            "AccessKeyId": "AKIAZZD4VWBSRSRAKFE5",
            "Status": "Active",
            "CreateDate": "2024-10-15T18:08:34+00:00"
        },
        {
            "UserName": "test",
            "AccessKeyId": "AKIAZZD4VWBSXPGOEF6T",
            "Status": "Active",
            "CreateDate": "2024-10-15T18:08:34+00:00"
        },
        {
            "UserName": "test",
            "AccessKeyId": "AKIAZZD4VWBSQ7GJYIIW",
            "Status": "Active",
            "CreateDate": "2024-10-15T18:08:34+00:00"
        }
    ]
}

```

Oleksii Bebych · Answer

I've tested it with WebUI and CLI

![Enter image description here](/media/postImages/original/IMCE2ijsM2QtKlGZttORRahg)

![Enter image description here](/media/postImages/original/IM2SOPtMWARpKuRBDEtnrZRw)

2 Access Keys are the maximum allowed

Do you see more than 2 keys in the console ?

swapzero · Answer

Oleksii Bebych, this is what happened when I ran the test mentioned in the first comment...again:

![AWS console screenshot](/media/postImages/original/IM-wQ7udusSP2AAv3Otc170A)

And this is the aws cli output:
```
$ aws iam list-access-keys --user-name test
{
    "AccessKeyMetadata": [
        {
            "UserName": "test",
            "AccessKeyId": "AKIAZZD4VWBS2V66MKOU",
            "Status": "Active",
            "CreateDate": "2024-10-15T17:51:28+00:00"
        },
        {
            "UserName": "test",
            "AccessKeyId": "AKIAZZD4VWBSR6Q3TKWY",
            "Status": "Active",
            "CreateDate": "2024-10-15T17:51:28+00:00"
        },
        {
            "UserName": "test",
            "AccessKeyId": "AKIAZZD4VWBS2RGYO5P6",
            "Status": "Active",
            "CreateDate": "2024-10-15T17:51:28+00:00"
        },
        {
            "UserName": "test",
            "AccessKeyId": "AKIAZZD4VWBSRUQBM7XI",
            "Status": "Active",
            "CreateDate": "2024-10-15T17:51:28+00:00"
        },
        {
            "UserName": "test",
            "AccessKeyId": "AKIAZZD4VWBSYYHOQ4D7",
            "Status": "Active",
            "CreateDate": "2024-10-15T17:51:28+00:00"
        }
    ]
}
```

I hope this clarifies everything. Just run the initial test :)

tanwani · Answer

AWS Identity and Access Management (IAM) team has investigated the issue related to IAM user access keys. The team identified that due to a race condition, an IAM user can have more than two access keys. All access keys associated with an IAM user are shown on the AWS management console and are returned as response of the ListAccessKeys API.

tanwani

answered 2 years ago

[bug report] [IAM] you can create more than 2 access keys per user

Add your answer

Relevant content