My company uses AWS for compute, storage, databases and more. However, they use the root key for access to everything and I'm trying to move away from that for security purposes. Any leak could result in catastrphic data leaks, or crippling bills from AWS. I'd like to prevent that as much as possible by permissioning keys (I know how to do that) and having keys auto expire after x weeks.
I've done a bit of exploration and haven't found something perfect. the closest I've found is the following. (We use Azure to authorize users to AWS) it's a tool that allows the aws cli access to aws by authorizing through azure: https://github.com/dtjohnson/aws-azure-login
The above gives us a daily authorization through the cli to access certain parts of AWS. However, that isn't exactly what we want. Management prefers longer expiry periods for convenience and we need actual keys to be able to use a tool like Cyberduck and to spin up instances in AWS, etc.
Is it possible to create keys by user that expire every X weeks and require a new request for a key?