First commits #1

jsf9k · 2024-08-30T17:24:04Z

🗣 Description

This pull request implements the Python code for an AWS Lambda function that will disable users' inactive console and programmatic access.

💭 Motivation and context

We have a POAM about disabling inactive users in IAM. Partially resolves cisagov/cool-system-internal#143.

🧪 Testing

I applied this module to our COOL Users account without incident.

✅ Pre-approval checklist

This PR has an informative and human-readable title.
Changes are limited to a single goal - eschew scope creep!
All relevant type-of-change labels have been added.
I have read the CONTRIBUTING document.
These code changes follow cisagov code standards.
All relevant repo and/or project documentation has been updated to reflect the changes in this PR.
All new and existing tests pass.

✅ Pre-merge checklist

Finalize version.

✅ Post-merge checklist

Create a release.

If a user's console access was created too recently then we cannot yet determine inactivity, so we should not disable it.

If a user's access key was created too recently then we cannot yet determine inactivity, so we should not disable it.

I also removed the run_lambda_locally section as it will not be used with this project.

Otherwise we cannot perform arithmetic such as now - login_profile_create, since the latter is timezone-aware.

This package is already available to Lambda functions.

…d response

…nsole access In such a case the "PasswordLastUsed" key does not exist for the user.

dav3r

Looks great! I noted a few thangs in validate_event_data that I think you overlooked.

src/lambda_handler.py

Co-authored-by: dav3r <david.redmin@trio.dhs.gov>

mcdonnnj

Please enable the dependabot ignore directives and fix the upstream repository reference in

disable-inactive-iam-users-lambda/.github/dependabot.yml

Lines 22 to 24 in 15fc27e

    
           # # Managed by cisagov/disable-inactive-iam-users-lambda 
        
           # - dependency-name: actions/upload-artifact 
        
           # - dependency-name: github/codeql-action

That reference changing suggests you have not updated your locally installed skeleton extension. Please update with gh extension upgrade --all to ensure you're working with the latest copy.

Also correct repo reference in comment. Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

jsf9k · 2024-09-02T17:30:21Z

Please enable the dependabot ignore directives and fix the upstream repository reference in

disable-inactive-iam-users-lambda/.github/dependabot.yml

Lines 22 to 24 in 15fc27e

# # Managed by cisagov/disable-inactive-iam-users-lambda

# - dependency-name: actions/upload-artifact

# - dependency-name: github/codeql-action

That reference changing suggests you have not updated your locally installed skeleton extension. Please update with gh extension upgrade --all to ensure you're working with the latest copy.

Please see commit 469a51f.

dv4harr10 · 2024-09-03T13:27:58Z

Hi Team, for README.md file section 'How to update Python dependencies' sentence 'More information about the Pipfile format can be found here.' The link from 'here' returns a 404 not found error.

jsf9k · 2024-09-03T14:48:38Z

Hi Team @ALL , for README.md file section 'How to update Python dependencies' sentence 'More information about the Pipfile format can be found here.' The link from 'here' returns a 404 not found error.

I created cisagov/skeleton-aws-lambda-python#32 to fix this upstream.

…Python This is the latest Python runtime we can currently support, given our AWS Terraform provider constraints. Co-authored-by: Dave Redmin <david.redmin@gwe.cisa.dhs.gov>

jsf9k · 2024-09-05T18:02:51Z

@mcdonnnj - This work is due tomorrow, and you are out of the office, so I am going to assume that you are satisfied with the changes I made in response to your review.

jsf9k added 14 commits August 29, 2024 10:18

First cut at creating this Lambda function

9f95a4e

Ensure that expiration_days is nonzero

cfab690

Correct the way I was using boto3 paginators

24997b9

Ignore access keys that are already inactive

025efba

Handle the case where a user's console access was created recently

47253b9

If a user's console access was created too recently then we cannot yet determine inactivity, so we should not disable it.

Handle the case where a user's access key was created recently

0834ed5

If a user's access key was created too recently then we cannot yet determine inactivity, so we should not disable it.

Update Pipfiles (and lock files) for this project

f9d6bea

Update Docker composition to match the needs of this project

8142ee4

I also removed the run_lambda_locally section as it will not be used with this project.

Correctly use boto3 IAM client exception class

f470e94

Make now a timezone-aware datetime object

8c9da65

Otherwise we cannot perform arithmetic such as now - login_profile_create, since the latter is timezone-aware.

Remove boto3 from the Pipfiles

a3b54ec

This package is already available to Lambda functions.

Correctly extract the last used date from the get_access_key_last_use…

1236fea

…d response

Correctly handle the case where the user has never used his or her co…

deaedec

…nsole access In such a case the "PasswordLastUsed" key does not exist for the user.

Add a debug message for the case where an access key is already inactive

d17992f

jsf9k added the improvement This issue or pull request will add new or improve existing functionality label Aug 30, 2024

jsf9k self-assigned this Aug 30, 2024

jsf9k added 2 commits August 30, 2024 13:27

Word-wrap paragraph to get rid of linting error

bba9e3b

Correct reference to repo that does not exist

aabbede

jsf9k force-pushed the first-commits branch from 0673d50 to aabbede Compare August 30, 2024 17:37

Uncomment code that actually does the disabling

1a2521a

mcdonnnj force-pushed the develop branch from be33491 to b4630a4 Compare August 30, 2024 18:20

This was referenced Aug 30, 2024

Add permissions necessary for cisagov/disable-inactive-iam-users-tf-module cisagov/provisionaccount-role-tf-module#45

Merged

First commits cisagov/disable-inactive-iam-users-tf-module#1

Merged

Disable inactive IAM users cisagov/cool-accounts#147

Merged

jsf9k marked this pull request as ready for review August 30, 2024 18:52

jsf9k requested review from dav3r, felddy and mcdonnnj as code owners August 30, 2024 18:52

jsf9k added 2 commits August 30, 2024 15:13

Bump version from 0.0.2 to 1.0.0

96a0f51

Bump version from 1.0.0 to 1.0.0-rc.1

e3ecd04

Set author label in Dockerfile to the VM dev distro

b6b80d6

jsf9k requested a review from a team August 30, 2024 19:19

dav3r approved these changes Aug 30, 2024

View reviewed changes

src/lambda_handler.py Outdated Show resolved Hide resolved

src/lambda_handler.py Outdated Show resolved Hide resolved

src/lambda_handler.py Outdated Show resolved Hide resolved

Fix copy-and-paste errors

78a4470

Co-authored-by: dav3r <david.redmin@trio.dhs.gov>

jsf9k force-pushed the first-commits branch from 87f0e55 to 78a4470 Compare August 30, 2024 20:07

mcdonnnj requested changes Aug 30, 2024

View reviewed changes

Uncomment Dependabot ignore lines

469a51f

Also correct repo reference in comment. Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

jsf9k requested a review from mcdonnnj September 2, 2024 17:30

Simplify timestamp logic

1e4f918

Add pydoc for task_disable() parameters

df9e9e2

dv4harr10 approved these changes Sep 3, 2024

View reviewed changes

Bump version from 1.0.0-rc.1 to 1.0.0-rc.2

15da8c6

jsf9k force-pushed the first-commits branch from a3c2823 to a8ad975 Compare September 4, 2024 18:07

Add support for Python 3.10 and remove support for older versions of …

311f8b8

…Python This is the latest Python runtime we can currently support, given our AWS Terraform provider constraints. Co-authored-by: Dave Redmin <david.redmin@gwe.cisa.dhs.gov>

jsf9k force-pushed the first-commits branch from a8ad975 to 311f8b8 Compare September 4, 2024 18:11

jsf9k added 2 commits September 4, 2024 14:55

Update workflow to only support Python 3.10 Lambda runtime

0336155

Finalize version from 1.0.0-rc.2 to 1.0.0

28f2b82

jsf9k merged commit 5dccdb5 into develop Sep 5, 2024

jsf9k deleted the first-commits branch September 5, 2024 18:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

First commits #1

First commits #1

Uh oh!

jsf9k commented Aug 30, 2024 •

edited

Loading

Uh oh!

dav3r left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mcdonnnj left a comment

Uh oh!

jsf9k commented Sep 2, 2024

Uh oh!

dv4harr10 commented Sep 3, 2024 •

edited by mcdonnnj

Loading

Uh oh!

jsf9k commented Sep 3, 2024

Uh oh!

jsf9k commented Sep 5, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	# # Managed by cisagov/disable-inactive-iam-users-lambda
	# - dependency-name: actions/upload-artifact
	# - dependency-name: github/codeql-action

First commits #1

First commits #1

Uh oh!

Conversation

jsf9k commented Aug 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🗣 Description

💭 Motivation and context

🧪 Testing

✅ Pre-approval checklist

✅ Pre-merge checklist

✅ Post-merge checklist

Uh oh!

dav3r left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mcdonnnj left a comment

Choose a reason for hiding this comment

Uh oh!

jsf9k commented Sep 2, 2024

Uh oh!

dv4harr10 commented Sep 3, 2024 • edited by mcdonnnj Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jsf9k commented Sep 3, 2024

Uh oh!

jsf9k commented Sep 5, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jsf9k commented Aug 30, 2024 •

edited

Loading

dv4harr10 commented Sep 3, 2024 •

edited by mcdonnnj

Loading