Detect when Temporary Credentials Present in Local awscli Config

[blakeca00]

Detect when Temporary Credentials Present in Local awscli Config. When temp credentials exist, keyup should be prohibited from rotating keys if and only if, a token is active.

If a token used to gen temp credentials is expired, keyup should rotate credentials.

Rationale: * If access keyset credentials are rotated with an ACITVE token, any active temp credentials will immediately become invalid bc the token used to generate them is no longer valid. (?)

[blakeca00]

Logic used to detect ACTIVE token:

• keyup run thru list of all iam users in the awscli config
• each user will be checked for prescence of a token generated by the corresponding IAM user
• any tokens found will have expiration datetime compared with now
• if not expired token == prohibit access key rotation
• log status, exit.

[blakeca00]

Logic:

1. Detect any awscli profiles which have 'aws_security_token' entry (iam users will not have)
2. Try to auth using these profiles to see if any are active by using keys with authenticated() function. If return True >> active
3. If some active, exit. Don't rotate creds
4. If all inactive, >> rotate credentials

[blakeca00]

Correct Logic:

1. Map profile names to Temporary profile names in order to discover which represent Iam users.
2. For the temporary credentials which represent real iam users, try to authenticate using the access key and secret key.
3. If any authenticate, exit without rotating keys
4. If all authentication fail, trigger rotation ( temporary credentials are expired.

Authentication using all temp credentials cannot be tried; will set of cw filter metric alarms for Auth Failure

[blakeca00]

Duplicate of #13.