aws-iam

# my-org/logins/production
values:
  aws:
    region: us-west-2
    login:
      fn::open::aws-login:
        oidc:
          roleArn: arn:aws:iam::123456789:role/esc-oidc
          sessionName: pulumi-environments-session
          subjectAttributes:
            - currentEnvironment.name

# my-org/rotators/key-rotator
values:
  iam:
    fn::rotate::aws-iam:
      inputs:
        region: ${environments.logins.production.aws.region}
        login: ${environments.logins.production.aws.login}
        userArn: arn:aws:iam::<account id>:user/<username>

# my-org/rotators/key-rotator
values:
  iam:
    fn::rotate::aws-iam:
      inputs:
        region: ${environments.logins.production.aws.region}
        login: ${environments.logins.production.aws.login}
        userArn: arn:aws:iam::<account id>:user/<username>
      state:
        current:
          accessKeyId: <access key>
          secretAccessKey:
            fn::secret: <secret key>
        previous:
          accessKeyId: <access key>
          secretAccessKey:
            fn::secret: <secret key>

{
  "aws": {
    "login": {
      "accessKeyId": "ASIA....",
      "secretAccessKey": "mWdm....",
      "sessionToken": "Fwo...."
    }
  },
  "iam": {
   "current": {
      "accessKeyId": "AKIA...",
      "createdAt": "2025-01-01T12:00:00Z",
      "secretAccessKey": "[secret]"
    },
    "previous": {
      "accessKeyId": "AKIA...",
      "createdAt": "2025-01-01T13:00:00Z",
      "secretAccessKey": "[secret]"
    }
  }
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:ListAccessKeys",
        "iam:CreateAccessKey",
        "iam:DeleteAccessKey",
        "iam:GetUser",
        "iam:TagUser"
      ],
      "Resource": "arn:aws:iam::<account id>:user/<username>"
    }
  ]
}