is there a CloudFormation way of uploading an SSH_PublicKey after a user is being created?

Question

I am trying to create an IAM user who has CodeCommit and S3 access only using CloudFormation, but also, i want to add the SSH_PublicKey, here is what I have so far:

Resources:
  ItS3User:
    DependsOn: ArtifactsBucket
    Type: AWS::IAM::User
    Properties:
      Policies:
      - PolicyName: ItS3Access
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Sid: AllowUserToSeeBucketListInTheConsole
            Action:
            - s3:ListAllMyBuckets
            - s3:GetBucketLocation
            Effect: Allow
            Resource:
            - arn:aws:s3:::*
          - Sid: AllowRootAndUploadsBucket
            Action:
            - s3:ListBucket
            Effect: Allow
            Resource:
            - Fn::Join:
              - ''
              - - 'arn:aws:s3:::'
                - Ref: ArtifactsBucket
            Condition:
              StringEquals:
                s3:prefix:
                - ''
                - it/
                s3:delimiter:
                - '/'
          - Sid: AllowListingOfUploadsFolder
            Action:
            - s3:ListBucket
            Effect: Allow
            Resource:
            - Fn::Join:
              - ''
              - - 'arn:aws:s3:::'
                - Ref: ArtifactsBucket
            Condition:
              StringLike:
                s3:prefix:
                - it/*
          - Sid: AllowAllS3ActionsInUploadsFolder
            Effect: Allow
            Action:
            - s3:PutObject
            - s3:GetObject
            - s3:GetObjectVersion
            Resource:
            - Fn::Join:
              - ''
              - - 'arn:aws:s3:::'
                - Ref: ArtifactsBucket
                - '/it'
                - '/*'

  ItUserAccessKey:
    DependsOn: ItS3User
    Type: AWS::IAM::AccessKey
    Properties:
      UserName:
        Ref: ItS3User


Outputs:
  ItUserAccessKeyID:
    Description: The Access Key for S3 bucket access
    Value:
      Ref: ItUserAccessKey
  ItUserAccessKeySecret:
    Description: The Access Key Secret for S3 bucket access
    Value:
      Fn::GetAtt:
        - ItUserAccessKey
        - SecretAccessKey

As per https://docs.aws.amazon.com/IAM/latest/APIReference/API_UploadSSHPublicKey.html

score 1 · Accepted Answer · answered Apr 06 '19 at 19:27

You can create a custom resource that will call UploadSSHPublicKey. Something similar to the following should work.

Don't forget to change the value of SSHPublicKeyBody to the key you need.

Resources:
  UploadSshKeyRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: UploadSSHKey
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action: iam:UploadSSHPublicKey
                Effect: Allow
                Resource: !Sub ${ItS3User.Arn}
  UploadKeyFunction:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.6
      Handler: index.handler
      Role: !Sub ${UploadSshKeyRole.Arn}
      Timeout: 60
      Code:
        ZipFile: |
          import boto3
          import cfnresponse
          import traceback

          def handler(event, context):
            try:
              response = boto3.client('iam').upload_ssh_public_key(
                  UserName=event['ResourceProperties']['Username'],
                  SSHPublicKeyBody=event['ResourceProperties']['SSHPublicKeyBody'],
              )

              cfnresponse.send(event, context, cfnresponse.SUCCESS, {}, "ok")
            except:
              traceback.print_last()
              cfnresponse.send(event, context, cfnresponse.FAIL, {}, "ok")
  UploadSshKey:
    Type: Custom::UploadSshKey
    Properties:
      ServiceToken: !Sub ${UploadKeyFunction.Arn}
      UserName: !Ref ItS3User
      SSHPublicKeyBody: "XXX INSERT PUBLIC KEY HERE XXX"

is there a CloudFormation way of uploading an SSH_PublicKey after a user is being created?

1 Answers1