Skip to main content
Version: 0.9

AWS

TokenTimer uses the AWS SDK v3 to discover secrets from Secrets Manager (with rotation dates), certificates from Certificate Manager (ACM), and IAM access keys across your AWS account.

Credential setup​

  1. AWS Console → IAM → Users → Create user
  2. Attach a custom policy (see permissions below)
  3. Create an Access Key → copy the Access Key ID and Secret Access Key
  4. Delete the user after use. Credentials are used once and never stored.

Option 2: AWS STS temporary credentials​

Use sts:AssumeRole to get temporary credentials with a Session Token.

IAM permissions required​

For Secrets Manager:

  • secretsmanager:ListSecrets
  • secretsmanager:DescribeSecret

For Certificate Manager (ACM):

  • acm:ListCertificates
  • acm:DescribeCertificate

For IAM access keys:

  • iam:ListUsers
  • iam:ListAccessKeys

Example IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:ListSecrets",
        "secretsmanager:DescribeSecret",
        "acm:ListCertificates",
        "acm:DescribeCertificate",
        "iam:ListUsers",
        "iam:ListAccessKeys"
      ],
      "Resource": "*"
    }
  ]
}

What is discovered​

  • Secrets Manager: name, ARN, description, rotation/deletion dates
  • Certificate Manager (ACM): domain names, SANs, expiration date, issuer, serial number, status, in-use status
  • IAM access keys: user name, key ID, status, creation date

Metadata only. No secret values, private keys, or certificate private keys are retrieved.

info

AWS does not expose expiration dates for IAM access keys, so they are imported as Never expires (2099-12-31). You can set expiration dates manually after import.

info

AWS does not support auto-sync on self-hosted TokenTimer. Each scan is a one-time, manual action; credentials are used once and never stored.