docs: add SetUserStatus and UpdateAccessKey documentation

Document new IAM actions for user and access key status management:
- SetUserStatus: Enable/disable users without deleting
- UpdateAccessKey: Change access key status (Active/Inactive)

Related to seaweedfs/seaweedfs#7745
chrislusf committed 2025-12-14 17:29:15 -08:00
1 parent 5d68eca9c5
commit 9e3abc7bbf
2 files changed
+97

No files matched your search

+30
@@ -87,6 +87,18 @@ aws --endpoint $AWS_ENDPOINT iam get-user --user-name bob
aws --endpoint $AWS_ENDPOINT iam delete-user --user-name bob
```
### Enable/Disable User
Disable or re-enable a user without deleting them:
```bash
# Disable a user (all their access keys will stop working)
aws --endpoint $AWS_ENDPOINT iam set-user-status --user-name bob --status Inactive
# Re-enable the user
aws --endpoint $AWS_ENDPOINT iam set-user-status --user-name bob --status Active
```
---
## Access Key Management
@@ -134,6 +146,24 @@ Output:
aws --endpoint $AWS_ENDPOINT iam delete-access-key --user-name bob --access-key-id X8R439UM7OSQJX28I9QTP
```
### Update Access Key Status
Deactivate or reactivate an access key without deleting it:
```bash
# Deactivate an access key
aws --endpoint $AWS_ENDPOINT iam update-access-key \
--user-name bob \
--access-key-id X8R439UM7OSQJX28I9QTP \
--status Inactive
# Reactivate the access key
aws --endpoint $AWS_ENDPOINT iam update-access-key \
--user-name bob \
--access-key-id X8R439UM7OSQJX28I9QTP \
--status Active
```
### Self-Service: Manage Your Own Keys
Users can manage their own access keys without admin privileges:
+67
@@ -55,8 +55,10 @@ weed iam -filer=localhost:8888 -port=8111
| `GetUser` | Get user details | Yes (own user) |
| `UpdateUser` | Update user properties | Admin only |
| `ListUsers` | List all users | Admin only |
| `SetUserStatus` | Enable or disable a user | Admin only |
| `CreateAccessKey` | Create access key for user | Yes (own keys) |
| `DeleteAccessKey` | Delete access key | Yes (own keys) |
| `UpdateAccessKey` | Change access key status (Active/Inactive) | Yes (own keys) |
| `ListAccessKeys` | List access keys for user | Yes (own keys) |
| `CreatePolicy` | Validate a policy document | Admin only |
| `PutUserPolicy` | Attach inline policy to user | Admin only |
@@ -156,6 +158,71 @@ aws --endpoint $AWS_ENDPOINT iam create-access-key
# List own access keys
aws --endpoint $AWS_ENDPOINT iam list-access-keys
# Deactivate an access key (key rotation)
aws --endpoint $AWS_ENDPOINT iam update-access-key --access-key-id AKIAEXAMPLE --status Inactive
```
---
## User and Access Key Status Management
SeaweedFS supports enabling/disabling users and access keys without deleting them. This is useful for:
- **Temporary suspension**: Disable user access during investigation
- **Key rotation**: Deactivate old keys before deletion
- **Offboarding**: Disable rather than delete for audit purposes
- **Emergency response**: Quickly disable compromised credentials
### Disable a User
```bash
# Disable a user (all their access keys will stop working)
aws --endpoint $AWS_ENDPOINT iam set-user-status --user-name alice --status Inactive
# Re-enable the user
aws --endpoint $AWS_ENDPOINT iam set-user-status --user-name alice --status Active
```
### Deactivate an Access Key
```bash
# Deactivate an access key
aws --endpoint $AWS_ENDPOINT iam update-access-key \
--user-name alice \
--access-key-id AKIAEXAMPLE \
--status Inactive
# Reactivate the access key
aws --endpoint $AWS_ENDPOINT iam update-access-key \
--user-name alice \
--access-key-id AKIAEXAMPLE \
--status Active
```
### Check Access Key Status
```bash
# List access keys shows their status
aws --endpoint $AWS_ENDPOINT iam list-access-keys --user-name alice
```
Output:
```json
{
"AccessKeyMetadata": [
{
"UserName": "alice",
"AccessKeyId": "X8R439UM7OSQJX28I9QTP",
"Status": "Active"
},
{
"UserName": "alice",
"AccessKeyId": "Y9S540VN8PTRKZ39J0URP",
"Status": "Inactive"
}
]
}
```
---