Securely provide AWS user with keys?

Question

When creating a new user in AWS IAM, an admin sets the user's name and permissions for that user. The user's password and programmatic access keys (if programmatic access is granted) are then generated and shown to the admin.

You successfully created the users shown below. You can view and download user security credentials. You can also email users instructions for signing in to the AWS Management Console. This is the last time these credentials will be available to download. However, you can create new credentials at any time.

What is the best way to share these keys with the new user?

Answer 1

The best way to share the information is to change the process you're using. A password can be generated and shared to the user through a myriad of secure methods. The key is to have the user change their own password on the next login.

Using this method the admin will not know the users password after they log in for the first time.

The second part of this is to allow the user to generate their own AWS Access keys. The following policy will allow a user to manage their own password and access keys.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:*AccessKey*",
                "iam:*LoginProfile",
                "iam:*SSHPublicKey*"
            ],
            "Resource": "arn:aws:iam::0123456789AB:user/${aws:username}"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "iam:GetAccountPasswordPolicy",
                "iam:GetAccountSummary",
                "iam:ListAccount*",
                "iam:ListUsers"
            ],
            "Resource": "*"
        }
    ]
}

I strongly suggest putting an AWS Lambda in place to disable/delete access keys that are over 90 days old and set the password expiration in IAM -> Account Settings.

Answer 2

That depends on your infrastructure/development environment set up. You could do several things.

If you have set up a system like Hashicorp Vault you could do all that within Vault.

Another possible solution would be ansible-vault which provides file-level encryption. The encrypted file can be checked in to your Version Control System. Obviously, you need a shared secret between the administrator and the user that should receive the API key.

Are you using PGP? Then your admin could sent the credentials in a PGP encrypted mail to the user.