Hi everyone!
I'm implementing sync of our LDAP/AD ...
# getting-starteda
acoustic-scientist-20961
05/08/2025, 1:08 PMHi everyone!
I'm implementing sync of our LDAP/AD to AWS users and groups trough Pulumi
and in case if user is disabled in LDAP I need to disable him in AWS.
In AWS Console there is an option to disable console login + I can disable all secret keys registered for that user
would you hint me how to do it in Pulumi? I don't see much options/args in
aws.iam.Userh
high-painter-73966
05/08/2025, 3:32 PMYou want to look at Access Keys: https://www.pulumi.com/registry/packages/aws/api-docs/iam/accesskey/ to control access keys and the ability to log into the console is controlled by https://www.pulumi.com/registry/packages/aws/api-docs/iam/userloginprofile/
high-painter-73966
05/08/2025, 3:33 PMYou might consider SAML integration as an alternative approach if you haven't already
a
acoustic-scientist-20961
05/08/2025, 3:33 PMis that correct approach:
Copy code
for key in aws.iam.get_access_keys(aws_user.name).access_keys:
key.update({"status":"Inactive"})acoustic-scientist-20961
05/08/2025, 3:34 PMand in
UserLoginProfileh
high-painter-73966
05/08/2025, 3:34 PMI think you delete the UserLoginProfile to prevent access
high-painter-73966
05/08/2025, 3:35 PMI haven't done this in Pulumi, but I'm presuming it is similar to how its down in Terraform, just triyng to help you keep moving forward
a
acoustic-scientist-20961
05/08/2025, 3:35 PMhmmm how do I delete it in pulumi?
acoustic-scientist-20961
05/08/2025, 3:36 PMi mean when we create it it trough pulumi, delete is simple
but we create aws.iam.User, not the
UserLoginProfileh
high-painter-73966
05/08/2025, 3:36 PMYou could import it and then delete it, or it might just be easier to use boto3 to do it in a single step.
a
acoustic-scientist-20961
05/08/2025, 3:36 PMah yes, good point, might use boto3 directly
acoustic-scientist-20961
05/08/2025, 3:37 PMneed to research on SAML, maybe I'm truly inventing the bicycle
h
high-painter-73966
05/08/2025, 3:39 PMYeah, SAML will sync between AD and Identity Center... then you control access using group membership and you don't have to actually disable console/keys, you just remove people from groups which means they can authenticate still but they don't have any permissions