Rotate the AWS access keys of the IAM users created by Terraform

[mikefox]

Is there a way to rotate the AWS access keys of the two IAM users (the one that can access the blobstore and the one that can deploy EC2 instances as explained here)? The keys in our AWS account that were set up by Control Tower are now over a year old. The lack of access key rotation is a common issue raised by penetration testing. I've scoured the documentation but can't find anything relating to this.

[crsimmons]

That isn't currently a feature of Control Tower (mostly because no one has ever requested it before). The users are created via terraform (bosh user & blobstore user).

I haven't tested it but I would think you could delete the user manually then re-run control-tower deploy and terraform should recreate the users and their keys. You may need to edit the terraform state as well (it's stored in the config S3 bucket).

We'd also be open to a PR if you want to take a stab at automating the process as part of the tool.

[friegger]

Deleting the user worked. The next redeploy created a new user. If I remember correctly we did not edit the terraform state.