diff --git a/moto/iam/models.py b/moto/iam/models.py index 602d5ae8b166..31554d68315e 100644 --- a/moto/iam/models.py +++ b/moto/iam/models.py @@ -1181,6 +1181,13 @@ def arn(self): def created_iso_8601(self): return iso_8601_datetime_with_milliseconds(self.create_date) + @property + def password_last_used_iso_8601(self): + if self.password_last_used is not None: + return iso_8601_datetime_with_milliseconds(self.password_last_used) + else: + return None + def get_policy(self, policy_name): policy_json = None try: diff --git a/moto/iam/responses.py b/moto/iam/responses.py index 06f2fa1e76c8..3a75e0367f9d 100644 --- a/moto/iam/responses.py +++ b/moto/iam/responses.py @@ -1805,6 +1805,9 @@ def get_service_linked_role_deletion_status(self): {{ user.id }} {{ user.created_iso_8601 }} {{ user.arn }} + {% if user.password_last_used_iso_8601 %} + {{ user.password_last_used_iso_8601 }} + {% endif %} {% if tags %} {% for tag in tags %} diff --git a/tests/test_iam/test_iam_password_last_used.py b/tests/test_iam/test_iam_password_last_used.py new file mode 100644 index 000000000000..c441b1cc3b24 --- /dev/null +++ b/tests/test_iam/test_iam_password_last_used.py @@ -0,0 +1,41 @@ +import boto3 +import pytz +from datetime import datetime, timedelta +from moto import mock_iam, settings +from moto.backends import get_backend +from moto.core import DEFAULT_ACCOUNT_ID as ACCOUNT_ID +from unittest import SkipTest + + +@mock_iam +def test_password_last_used(): + if settings.TEST_SERVER_MODE: + raise SkipTest("Can't set password_last_used in ServerMode") + client = boto3.client("iam", "us-east-1") + current_time = pytz.timezone("UTC").localize(datetime.utcnow()) + password_last_used_date = current_time - timedelta(days=100) + + username = "test.user" + client.create_user(Path="/staff/", UserName=username)["User"] + client.create_login_profile( + UserName=username, Password="Password1", PasswordResetRequired=False + ) + + access_key = client.create_access_key(UserName=username)["AccessKey"] + + as_new_user = boto3.resource( + "iam", + region_name="us-east-1", + aws_access_key_id=access_key["AccessKeyId"], + aws_secret_access_key=access_key["SecretAccessKey"], + ) + + # Username is set, but password not yet + assert as_new_user.CurrentUser().user_name == username + assert not as_new_user.CurrentUser().password_last_used + + iam_backend = get_backend("iam")[ACCOUNT_ID]["global"] + iam_backend.users[username].password_last_used = password_last_used_date + + # Password is returned now + assert as_new_user.CurrentUser().password_last_used