feat: add IAM user access key management

Add `CreateAccessKey`, `UpdateAccessKey`, `DeleteAccessKey`, `ListAccessKeys`, and `GetAccessKeyLastUsed` actions for managing user access keys and retrieving their latest usage details.

Generate AWS-style access key IDs and secrets, validate key identifiers and statuses, enforce per-user key quotas, and prevent deleting users that still own access keys. Persist access keys across internal and Vault storage backends with ownership indexing, pagination, and IAM-compatible errors and XML responses.

iamapi/controller.go

@@ -233,3 +233,200 @@ func (c IAMApiController) UpdateUser(ctx fiber.Ctx) (*Response, error) {
 		Result: types.UpdateUserResult{User: updated},
 	}}, nil
 }
+
+func (c IAMApiController) CreateAccessKey(ctx fiber.Ctx) (*Response, error) {
+	userName, ok := iamutil.RequestParam(ctx, "UserName")
+	if !ok || userName == "" {
+		debuglogger.Logf("missing required CreateAccessKey parameter: UserName")
+		return nil, iamerr.MissingParameter("UserName")
+	}
+	if err := iamutil.ValidateUserName("userName", userName, iamutil.MaxUserLookupLen); err != nil {
+		return nil, err
+	}
+
+	for range 3 {
+		accessKeyID, err := iamutil.GenerateAccessKeyID()
+		if err != nil {
+			return nil, err
+		}
+		secretAccessKey, err := iamutil.GenerateSecretAccessKey()
+		if err != nil {
+			return nil, err
+		}
+
+		stored, err := c.store.CreateAccessKey(ctx.Context(), storage.CreateAccessKeyInput{
+			UserName:        userName,
+			AccessKeyID:     accessKeyID,
+			SecretAccessKey: secretAccessKey,
+			Status:          iamutil.AccessKeyStatusActive,
+			CreateDate:      time.Now().UTC().Truncate(time.Second),
+		})
+		if errors.Is(err, storage.ErrAccessKeyIDAlreadyExists) {
+			debuglogger.Logf("IAM access key id collision for user %q: %v", userName, err)
+			continue
+		}
+		if err != nil {
+			debuglogger.Logf("failed to create IAM access key for user %q: %v", userName, err)
+			return nil, err
+		}
+
+		return &Response{
+			Data: &types.CreateAccessKeyResponse{
+				Result: types.CreateAccessKeyResult{AccessKey: *stored},
+			},
+		}, nil
+	}
+
+	err := fmt.Errorf("generate IAM access key id: exhausted collision retries")
+	debuglogger.Logf("failed to create IAM access key for user %q: %v", userName, err)
+	return nil, err
+}
+
+func (c IAMApiController) UpdateAccessKey(ctx fiber.Ctx) (*Response, error) {
+	userName, ok := iamutil.RequestParam(ctx, "UserName")
+	if !ok || userName == "" {
+		debuglogger.Logf("missing required UpdateAccessKey parameter: UserName")
+		return nil, iamerr.MissingParameter("UserName")
+	}
+	if err := iamutil.ValidateUserName("userName", userName, iamutil.MaxUserLookupLen); err != nil {
+		return nil, err
+	}
+
+	accessKeyID, ok := iamutil.RequestParam(ctx, "AccessKeyId")
+	if !ok || accessKeyID == "" {
+		debuglogger.Logf("missing required UpdateAccessKey parameter: AccessKeyId")
+		return nil, iamerr.MissingParameter("AccessKeyId")
+	}
+	if err := iamutil.ValidateAccessKeyID(accessKeyID); err != nil {
+		return nil, err
+	}
+
+	status, ok := iamutil.RequestParam(ctx, "Status")
+	if !ok || status == "" {
+		debuglogger.Logf("missing required UpdateAccessKey parameter: Status")
+		return nil, iamerr.MissingParameter("Status")
+	}
+	if err := iamutil.ValidateAccessKeyStatus(status); err != nil {
+		return nil, err
+	}
+
+	if err := c.store.UpdateAccessKey(ctx.Context(), storage.UpdateAccessKeyInput{
+		UserName:    userName,
+		AccessKeyID: accessKeyID,
+		Status:      status,
+	}); err != nil {
+		debuglogger.Logf("failed to update IAM access key %q for user %q: %v", accessKeyID, userName, err)
+		return nil, err
+	}
+
+	return &Response{Data: &types.UpdateAccessKeyResponse{}}, nil
+}
+
+func (c IAMApiController) DeleteAccessKey(ctx fiber.Ctx) (*Response, error) {
+	userName, ok := iamutil.RequestParam(ctx, "UserName")
+	if !ok || userName == "" {
+		debuglogger.Logf("missing required DeleteAccessKey parameter: UserName")
+		return nil, iamerr.MissingParameter("UserName")
+	}
+	if err := iamutil.ValidateUserName("userName", userName, iamutil.MaxUserLookupLen); err != nil {
+		return nil, err
+	}
+
+	accessKeyID, ok := iamutil.RequestParam(ctx, "AccessKeyId")
+	if !ok || accessKeyID == "" {
+		debuglogger.Logf("missing required DeleteAccessKey parameter: AccessKeyId")
+		return nil, iamerr.MissingParameter("AccessKeyId")
+	}
+	if err := iamutil.ValidateAccessKeyID(accessKeyID); err != nil {
+		return nil, err
+	}
+
+	if err := c.store.DeleteAccessKey(ctx.Context(), userName, accessKeyID); err != nil {
+		debuglogger.Logf("failed to delete IAM access key %q for user %q: %v", accessKeyID, userName, err)
+		return nil, err
+	}
+
+	return &Response{Data: &types.DeleteAccessKeyResponse{}}, nil
+}
+
+func (c IAMApiController) GetAccessKeyLastUsed(ctx fiber.Ctx) (*Response, error) {
+	accessKeyID, ok := iamutil.RequestParam(ctx, "AccessKeyId")
+	if !ok || accessKeyID == "" {
+		debuglogger.Logf("missing required GetAccessKeyLastUsed parameter: AccessKeyId")
+		return nil, iamerr.MissingParameter("AccessKeyId")
+	}
+	if err := iamutil.ValidateAccessKeyID(accessKeyID); err != nil {
+		return nil, err
+	}
+
+	out, err := c.store.GetAccessKeyLastUsed(ctx.Context(), accessKeyID)
+	if err != nil {
+		debuglogger.Logf("failed to get IAM access key last used %q: %v", accessKeyID, err)
+		return nil, err
+	}
+
+	serviceName := out.ServiceName
+	if serviceName == "" {
+		serviceName = "N/A"
+	}
+	region := out.Region
+	if region == "" {
+		region = "N/A"
+	}
+
+	var lastUsedDate *time.Time
+	if !out.LastUsedDate.IsZero() {
+		lastUsedDate = &out.LastUsedDate
+	}
+
+	return &Response{Data: &types.GetAccessKeyLastUsedResponse{
+		Result: types.GetAccessKeyLastUsedResult{
+			UserName: out.UserName,
+			AccessKeyLastUsed: types.AccessKeyLastUsed{
+				LastUsedDate: lastUsedDate,
+				ServiceName:  serviceName,
+				Region:       region,
+			},
+		},
+	}}, nil
+}
+
+func (c IAMApiController) ListAccessKeys(ctx fiber.Ctx) (*Response, error) {
+	userName, ok := iamutil.RequestParam(ctx, "UserName")
+	if !ok || userName == "" {
+		debuglogger.Logf("missing required ListAccessKeys parameter: UserName")
+		return nil, iamerr.MissingParameter("UserName")
+	}
+	if err := iamutil.ValidateUserName("userName", userName, iamutil.MaxUserLookupLen); err != nil {
+		return nil, err
+	}
+
+	maxItems := int32(iamutil.DefaultMaxItems)
+	if rawMaxItems, ok := iamutil.RequestParam(ctx, "MaxItems"); ok && rawMaxItems != "" {
+		parsed, err := strconv.ParseInt(rawMaxItems, 10, 32)
+		if err != nil || parsed < 1 || parsed > iamutil.MaxListItems {
+			debuglogger.Logf("invalid ListAccessKeys MaxItems value %q: parse_error=%v", rawMaxItems, err)
+			return nil, iamerr.InvalidMaxItems(rawMaxItems)
+		}
+		maxItems = int32(parsed)
+	}
+
+	marker, _ := iamutil.RequestParam(ctx, "Marker")
+	out, err := c.store.ListAccessKeys(ctx.Context(), storage.ListAccessKeysInput{
+		UserName: userName,
+		Marker:   marker,
+		MaxItems: maxItems,
+	})
+	if err != nil {
+		debuglogger.Logf("failed to list IAM access keys for user %q: %v", userName, err)
+		return nil, err
+	}
+
+	return &Response{Data: &types.ListAccessKeysResponse{
+		Result: types.ListAccessKeysResult{
+			AccessKeyMetadata: types.AccessKeyMetadataList{Members: out.AccessKeys},
+			IsTruncated:       out.IsTruncated,
+			Marker:            out.Marker,
+		},
+	}}, nil
+}

iamapi/iamerr/errors.go

@@ -52,14 +52,14 @@ const (
 	ErrInvalidRegion
 	ErrMissingHostSignedHeader
 	ErrInvalidClientTokenID
-
 	ErrInvalidContentLength
 	ErrThrottling
-
 	ErrMissingUserNameValue
 	ErrTooManyTags
 	ErrInvalidPathPrefix
 	ErrDuplicateTagKeys
+	ErrInvalidAccessKeyIDChars
+	ErrDeleteConflict
 )
 
 type APIError interface {
@@ -123,7 +123,6 @@ var errorCodeResponse = map[ErrorCode]Error{
 		Message:        "The request processing has failed because of an unknown error, exception or failure.",
 		HTTPStatusCode: http.StatusInternalServerError,
 	},
-
 	ErrInvalidContentLength: {
 		Type:           TypeSender,
 		Code:           "InvalidRequest",
@@ -136,7 +135,6 @@ var errorCodeResponse = map[ErrorCode]Error{
 		Message:        "Rate exceeded.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
-
 	ErrMissingAuthenticationToken: {
 		Type:           TypeSender,
 		Code:           "MissingAuthenticationToken",
@@ -155,7 +153,6 @@ var errorCodeResponse = map[ErrorCode]Error{
 		Message:        "The security token included in the request is invalid.",
 		HTTPStatusCode: http.StatusForbidden,
 	},
-
 	ErrIncompleteSignature: {
 		Type:           TypeSender,
 		Code:           "IncompleteSignature",
@@ -174,7 +171,6 @@ var errorCodeResponse = map[ErrorCode]Error{
 		Message:        "Authorization header requires Credential, SignedHeaders, and Signature.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
-
 	ErrSignatureDoesNotMatch: {
 		Type:           TypeSender,
 		Code:           "SignatureDoesNotMatch",
@@ -211,7 +207,6 @@ var errorCodeResponse = map[ErrorCode]Error{
 		Message:        "'Host' or ':authority' must be a 'SignedHeader' in the AWS Authorization.",
 		HTTPStatusCode: http.StatusForbidden,
 	},
-
 	ErrMissingUserNameValue: {
 		Type:           TypeSender,
 		Code:           "ValidationError",
@@ -236,6 +231,18 @@ var errorCodeResponse = map[ErrorCode]Error{
 		Message:        "Duplicate tag keys found. Please note that Tag keys are case insensitive.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
+	ErrInvalidAccessKeyIDChars: {
+		Type:           TypeSender,
+		Code:           "ValidationError",
+		Message:        "The specified value for accessKeyId is invalid. It must contain only alphanumeric characters.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrDeleteConflict: {
+		Type:           TypeSender,
+		Code:           "DeleteConflict",
+		Message:        "Cannot delete entity, must delete access keys first.",
+		HTTPStatusCode: http.StatusConflict,
+	},
 }
 
 func GetAPIError(code ErrorCode) Error {
@@ -334,6 +341,14 @@ func NoSuchEntityUser(userName string) Error {
 	return newSenderError("NoSuchEntity", fmt.Sprintf("The user with name %s cannot be found.", userName), http.StatusNotFound)
 }
 
+func NoSuchEntityAccessKey(accessKeyID string) Error {
+	return newSenderError("NoSuchEntity", fmt.Sprintf("The Access Key with id %s cannot be found", accessKeyID), http.StatusNotFound)
+}
+
+func AccessKeysLimitExceeded(maxKeys int) Error {
+	return newSenderError("LimitExceeded", fmt.Sprintf("Cannot exceed quota for AccessKeysPerUser: %d", maxKeys), http.StatusConflict)
+}
+
 func ValidationError(message string) Error {
 	return newSenderError("ValidationError", message, http.StatusBadRequest)
 }
@@ -362,6 +377,18 @@ func InvalidMaxItems(value string) Error {
 	return ValidationError(fmt.Sprintf("1 validation error detected: Value '%s' at 'maxItems' failed to satisfy constraint: Member must have value between 1 and 1000", value))
 }
 
+func AccessKeyIDTooShort(minLength int) Error {
+	return ValidationError(fmt.Sprintf("1 validation error detected: Value at 'accessKeyId' failed to satisfy constraint: Member must have length greater than or equal to %d", minLength))
+}
+
+func AccessKeyIDTooLong(maxLength int) Error {
+	return ValidationError(fmt.Sprintf("1 validation error detected: Value at 'accessKeyId' failed to satisfy constraint: Member must have length less than or equal to %d", maxLength))
+}
+
+func InvalidAccessKeyStatus(value string) Error {
+	return ValidationError(fmt.Sprintf("1 validation error detected: Value '%s' at 'status' failed to satisfy constraint: Member must satisfy enum value set: [Active, Inactive]", value))
+}
+
 func TagKeyTooLong(index int) Error {
 	return ValidationError(fmt.Sprintf("1 validation error detected: Value at 'tags.%d.member.key' failed to satisfy constraint: Member must have length less than or equal to 128", index))
 }

iamapi/internal/iamutil/access_key.go

@@ -0,0 +1,88 @@
+// Copyright 2026 Versity Software
+// This file is licensed under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package iamutil
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"regexp"
+
+	"github.com/versity/versitygw/debuglogger"
+	"github.com/versity/versitygw/iamapi/iamerr"
+)
+
+const (
+	AccessKeyStatusActive   = "Active"
+	AccessKeyStatusInactive = "Inactive"
+
+	accessKeyIDPrefix    = "AKIA"
+	accessKeyIDRandomLen = 17
+	minAccessKeyIDLen    = 16
+	maxAccessKeyIDLen    = 128
+	secretAccessKeyBytes = 30
+)
+
+var accessKeyIDPattern = regexp.MustCompile(`^[\w]+$`)
+
+// GenerateAccessKeyID returns a new cryptographically random IAM access key
+// id in the AKIA… format.
+func GenerateAccessKeyID() (string, error) {
+	id, err := generateAWSID(accessKeyIDPrefix, accessKeyIDRandomLen)
+	if err != nil {
+		debuglogger.Logf("failed to generate IAM access key id: %v", err)
+		return "", err
+	}
+	return id, nil
+}
+
+// GenerateSecretAccessKey returns a new cryptographically random 40 character
+// secret access key.
+func GenerateSecretAccessKey() (string, error) {
+	b := make([]byte, secretAccessKeyBytes)
+	if _, err := rand.Read(b); err != nil {
+		debuglogger.Logf("failed to generate IAM secret access key: %v", err)
+		return "", err
+	}
+	return base64.StdEncoding.EncodeToString(b), nil
+}
+
+// ValidateAccessKeyID checks that accessKeyID fits within the allowed length
+// range and character set.
+func ValidateAccessKeyID(accessKeyID string) error {
+	if len(accessKeyID) < minAccessKeyIDLen {
+		debuglogger.Logf("IAM access key id too short: value=%q", accessKeyID)
+		return iamerr.AccessKeyIDTooShort(minAccessKeyIDLen)
+	}
+	if len(accessKeyID) > maxAccessKeyIDLen {
+		debuglogger.Logf("IAM access key id too long: value=%q", accessKeyID)
+		return iamerr.AccessKeyIDTooLong(maxAccessKeyIDLen)
+	}
+	if !accessKeyIDPattern.MatchString(accessKeyID) {
+		debuglogger.Logf("invalid IAM access key id characters: value=%q", accessKeyID)
+		return iamerr.GetAPIError(iamerr.ErrInvalidAccessKeyIDChars)
+	}
+
+	return nil
+}
+
+// ValidateAccessKeyStatus checks that status is either Active or Inactive.
+func ValidateAccessKeyStatus(status string) error {
+	if status != AccessKeyStatusActive && status != AccessKeyStatusInactive {
+		debuglogger.Logf("invalid IAM access key status: %q", status)
+		return iamerr.InvalidAccessKeyStatus(status)
+	}
+
+	return nil
+}

iamapi/internal/iamutil/user.go

@@ -151,15 +151,25 @@ func BuildUserArn(accountID, path, userName string) string {
 
 // GenerateUserID returns a new cryptographically random IAM user ID in the AIDA… format.
 func GenerateUserID() (string, error) {
+	id, err := generateAWSID(userIDPrefix, userIDRandomLen)
+	if err != nil {
+		debuglogger.Logf("failed to generate IAM user ID: %v", err)
+		return "", err
+	}
+	return id, nil
+}
+
+// generateAWSID builds an AWS-style unique identifier: a fixed prefix
+// followed by randomLen characters drawn from userIDAlphabet.
+func generateAWSID(prefix string, randomLen int) (string, error) {
 	var b strings.Builder
-	b.Grow(len(userIDPrefix) + userIDRandomLen)
-	b.WriteString(userIDPrefix)
+	b.Grow(len(prefix) + randomLen)
+	b.WriteString(prefix)
 
 	max := big.NewInt(int64(len(userIDAlphabet)))
-	for range userIDRandomLen {
+	for range randomLen {
 		n, err := rand.Int(rand.Reader, max)
 		if err != nil {
-			debuglogger.Logf("failed to generate IAM user ID: %v", err)
 			return "", err
 		}
 		b.WriteByte(userIDAlphabet[n.Int64()])

iamapi/router.go

@@ -45,11 +45,18 @@ func (r *IAMApiRouter) Init() {
 	r.Ctrl = ctrl
 
 	r.actions = map[string]ActionHandler{
+		// User CRUD
 		"CreateUser": ctrl.CreateUser,
 		"DeleteUser": ctrl.DeleteUser,
 		"GetUser":    ctrl.GetUser,
 		"ListUsers":  ctrl.ListUsers,
 		"UpdateUser": ctrl.UpdateUser,
+		// User Access Key CRUD
+		"CreateAccessKey":      ctrl.CreateAccessKey,
+		"UpdateAccessKey":      ctrl.UpdateAccessKey,
+		"DeleteAccessKey":      ctrl.DeleteAccessKey,
+		"GetAccessKeyLastUsed": ctrl.GetAccessKeyLastUsed,
+		"ListAccessKeys":       ctrl.ListAccessKeys,
 	}
 
 	actionRoute := ProcessHandlers(r.routeAction, iammiddleware.VerifyIAMAuth(r.rootCreds))

iamapi/storage/internal.go

@@ -50,16 +50,25 @@ func NewInternal(dir string) (Storer, error) {
 
 type iamConfig struct {
 	Users map[string]types.User `json:"users"`
+	// AccessKeyIndex maps an access key id to the username that owns it,
+	// so GetAccessKeyLastUsed can resolve a key without scanning every user.
+	AccessKeyIndex map[string]string `json:"accessKeyIndex"`
 }
 
 func defaultIAMConfig() iamConfig {
-	return iamConfig{Users: map[string]types.User{}}
+	return iamConfig{
+		Users:          map[string]types.User{},
+		AccessKeyIndex: map[string]string{},
+	}
 }
 
 func normalizeIAMConfig(conf *iamConfig) {
 	if conf.Users == nil {
 		conf.Users = make(map[string]types.User)
 	}
+	if conf.AccessKeyIndex == nil {
+		conf.AccessKeyIndex = make(map[string]string)
+	}
 }
 
 func (s *InternalStore) CreateUser(_ context.Context, user types.User) (*types.User, error) {
@@ -100,9 +109,13 @@ func (s *InternalStore) DeleteUser(_ context.Context, username string) error {
 			return nil, err
 		}
 
-		if _, ok := conf.Users[username]; !ok {
+		user, ok := conf.Users[username]
+		if !ok {
 			return nil, iamerr.NoSuchEntityUser(username)
 		}
+		if len(user.AccessKeys) > 0 {
+			return nil, iamerr.GetAPIError(iamerr.ErrDeleteConflict)
+		}
 
 		delete(conf.Users, username)
 		return json.Marshal(conf)
@@ -214,6 +227,9 @@ func (s *InternalStore) UpdateUser(_ context.Context, input UpdateUserInput) (*t
 
 		if user.UserName != input.UserName {
 			delete(conf.Users, input.UserName)
+			for _, key := range user.AccessKeys {
+				conf.AccessKeyIndex[key.AccessKeyId] = user.UserName
+			}
 		}
 		conf.Users[user.UserName] = user
 		updated = user
@@ -226,8 +242,212 @@ func (s *InternalStore) UpdateUser(_ context.Context, input UpdateUserInput) (*t
 	return cloneUser(updated), nil
 }
 
+func (s *InternalStore) CreateAccessKey(_ context.Context, input CreateAccessKeyInput) (*types.AccessKey, error) {
+	s.Lock()
+	defer s.Unlock()
+
+	var created types.AccessKey
+	if err := s.engine.StoreIAM(func(data []byte) ([]byte, error) {
+		conf, err := s.engine.ParseIAM(data)
+		if err != nil {
+			return nil, err
+		}
+
+		user, ok := conf.Users[input.UserName]
+		if !ok {
+			return nil, iamerr.NoSuchEntityUser(input.UserName)
+		}
+		if len(user.AccessKeys) >= MaxAccessKeysPerUser {
+			return nil, iamerr.AccessKeysLimitExceeded(MaxAccessKeysPerUser)
+		}
+		if _, ok := conf.AccessKeyIndex[input.AccessKeyID]; ok {
+			return nil, ErrAccessKeyIDAlreadyExists
+		}
+
+		user.AccessKeys = append(user.AccessKeys, types.AccessKeyEntry{
+			AccessKeyId:     input.AccessKeyID,
+			SecretAccessKey: input.SecretAccessKey,
+			Status:          input.Status,
+			CreateDate:      input.CreateDate,
+		})
+		conf.Users[input.UserName] = user
+		conf.AccessKeyIndex[input.AccessKeyID] = input.UserName
+
+		created = types.AccessKey{
+			UserName:        input.UserName,
+			AccessKeyId:     input.AccessKeyID,
+			Status:          input.Status,
+			SecretAccessKey: input.SecretAccessKey,
+			CreateDate:      input.CreateDate,
+		}
+
+		return json.Marshal(conf)
+	}); err != nil {
+		return nil, unwrapAPIError(err)
+	}
+
+	return &created, nil
+}
+
+func (s *InternalStore) UpdateAccessKey(_ context.Context, input UpdateAccessKeyInput) error {
+	s.Lock()
+	defer s.Unlock()
+
+	err := s.engine.StoreIAM(func(data []byte) ([]byte, error) {
+		conf, err := s.engine.ParseIAM(data)
+		if err != nil {
+			return nil, err
+		}
+
+		user, ok := conf.Users[input.UserName]
+		if !ok {
+			return nil, iamerr.NoSuchEntityUser(input.UserName)
+		}
+
+		found := false
+		for i, key := range user.AccessKeys {
+			if key.AccessKeyId == input.AccessKeyID {
+				user.AccessKeys[i].Status = input.Status
+				found = true
+				break
+			}
+		}
+		if !found {
+			return nil, iamerr.NoSuchEntityAccessKey(input.AccessKeyID)
+		}
+
+		conf.Users[input.UserName] = user
+		return json.Marshal(conf)
+	})
+	return unwrapAPIError(err)
+}
+
+func (s *InternalStore) DeleteAccessKey(_ context.Context, username, accessKeyID string) error {
+	s.Lock()
+	defer s.Unlock()
+
+	err := s.engine.StoreIAM(func(data []byte) ([]byte, error) {
+		conf, err := s.engine.ParseIAM(data)
+		if err != nil {
+			return nil, err
+		}
+
+		user, ok := conf.Users[username]
+		if !ok {
+			return nil, iamerr.NoSuchEntityUser(username)
+		}
+
+		idx := -1
+		for i, key := range user.AccessKeys {
+			if key.AccessKeyId == accessKeyID {
+				idx = i
+				break
+			}
+		}
+		if idx == -1 {
+			return nil, iamerr.NoSuchEntityAccessKey(accessKeyID)
+		}
+
+		user.AccessKeys = slices.Delete(user.AccessKeys, idx, idx+1)
+		conf.Users[username] = user
+		delete(conf.AccessKeyIndex, accessKeyID)
+
+		return json.Marshal(conf)
+	})
+	return unwrapAPIError(err)
+}
+
+func (s *InternalStore) GetAccessKeyLastUsed(_ context.Context, accessKeyID string) (*GetAccessKeyLastUsedOutput, error) {
+	s.RLock()
+	defer s.RUnlock()
+
+	conf, err := s.engine.GetIAM()
+	if err != nil {
+		return nil, err
+	}
+
+	username, ok := conf.AccessKeyIndex[accessKeyID]
+	if !ok {
+		return nil, iamerr.NoSuchEntityAccessKey(accessKeyID)
+	}
+	user, ok := conf.Users[username]
+	if !ok {
+		return nil, iamerr.NoSuchEntityAccessKey(accessKeyID)
+	}
+
+	for _, key := range user.AccessKeys {
+		if key.AccessKeyId == accessKeyID {
+			return &GetAccessKeyLastUsedOutput{
+				UserName:     username,
+				LastUsedDate: key.LastUsedDate,
+				ServiceName:  key.LastUsedService,
+				Region:       key.LastUsedRegion,
+			}, nil
+		}
+	}
+
+	return nil, iamerr.NoSuchEntityAccessKey(accessKeyID)
+}
+
+func (s *InternalStore) ListAccessKeys(_ context.Context, input ListAccessKeysInput) (*ListAccessKeysOutput, error) {
+	s.RLock()
+	defer s.RUnlock()
+
+	conf, err := s.engine.GetIAM()
+	if err != nil {
+		return nil, err
+	}
+
+	user, ok := conf.Users[input.UserName]
+	if !ok {
+		return nil, iamerr.NoSuchEntityUser(input.UserName)
+	}
+
+	keys := make([]types.AccessKeyMetadata, 0, len(user.AccessKeys))
+	for _, key := range user.AccessKeys {
+		keys = append(keys, types.AccessKeyMetadata{
+			UserName:    input.UserName,
+			AccessKeyId: key.AccessKeyId,
+			Status:      key.Status,
+			CreateDate:  key.CreateDate,
+		})
+	}
+	sort.Slice(keys, func(i, j int) bool {
+		return keys[i].AccessKeyId < keys[j].AccessKeyId
+	})
+
+	start := 0
+	if input.Marker != "" {
+		start = len(keys)
+		for i, key := range keys {
+			if key.AccessKeyId == input.Marker {
+				start = i + 1
+				break
+			}
+		}
+	}
+	keys = keys[start:]
+
+	limit := len(keys)
+	if input.MaxItems > 0 && int(input.MaxItems) < limit {
+		limit = int(input.MaxItems)
+	}
+
+	out := &ListAccessKeysOutput{
+		AccessKeys: make([]types.AccessKeyMetadata, limit),
+	}
+	copy(out.AccessKeys, keys[:limit])
+	if limit < len(keys) {
+		out.IsTruncated = true
+		out.Marker = out.AccessKeys[limit-1].AccessKeyId
+	}
+
+	return out, nil
+}
+
 func cloneUser(user types.User) *types.User {
 	cloned := user
 	cloned.Tags = slices.Clone(user.Tags)
+	cloned.AccessKeys = slices.Clone(user.AccessKeys)
 	return &cloned
 }

iamapi/storage/storer.go

@@ -19,13 +19,19 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+	"time"
 
 	"github.com/versity/versitygw/iamapi/iamerr"
 	"github.com/versity/versitygw/iamapi/types"
 )
 
+// MaxAccessKeysPerUser is the maximum number of access keys a single IAM
+// user may hold at once, matching the AWS IAM quota.
+const MaxAccessKeysPerUser = 2
+
 var (
-	ErrUserIDAlreadyExists = errors.New("iamapi: user id already exists")
+	ErrUserIDAlreadyExists      = errors.New("iamapi: user id already exists")
+	ErrAccessKeyIDAlreadyExists = errors.New("iamapi: access key id already exists")
 )
 
 type ListUsersInput struct {
@@ -47,6 +53,39 @@ type UpdateUserInput struct {
 	NewArn      string
 }
 
+type CreateAccessKeyInput struct {
+	UserName        string
+	AccessKeyID     string
+	SecretAccessKey string
+	Status          string
+	CreateDate      time.Time
+}
+
+type UpdateAccessKeyInput struct {
+	UserName    string
+	AccessKeyID string
+	Status      string
+}
+
+type ListAccessKeysInput struct {
+	UserName string
+	Marker   string
+	MaxItems int32
+}
+
+type ListAccessKeysOutput struct {
+	AccessKeys  []types.AccessKeyMetadata
+	IsTruncated bool
+	Marker      string
+}
+
+type GetAccessKeyLastUsedOutput struct {
+	UserName     string
+	LastUsedDate time.Time
+	ServiceName  string
+	Region       string
+}
+
 // Storer is the IAM API storage backend contract.
 type Storer interface {
 	CreateUser(ctx context.Context, user types.User) (*types.User, error)
@@ -54,6 +93,12 @@ type Storer interface {
 	GetUser(ctx context.Context, username string) (*types.User, error)
 	ListUsers(ctx context.Context, input ListUsersInput) (*ListUsersOutput, error)
 	UpdateUser(ctx context.Context, input UpdateUserInput) (*types.User, error)
+
+	CreateAccessKey(ctx context.Context, input CreateAccessKeyInput) (*types.AccessKey, error)
+	UpdateAccessKey(ctx context.Context, input UpdateAccessKeyInput) error
+	DeleteAccessKey(ctx context.Context, username, accessKeyID string) error
+	GetAccessKeyLastUsed(ctx context.Context, accessKeyID string) (*GetAccessKeyLastUsedOutput, error)
+	ListAccessKeys(ctx context.Context, input ListAccessKeysInput) (*ListAccessKeysOutput, error)
 }
 
 func unwrapAPIError(err error) error {

iamapi/storage/storer_test.go

@@ -198,6 +198,22 @@ func TestInternalStoreUserCRUDAndPagination(t *testing.T) {
 		t.Fatalf("reopened tags = %#v, want %#v", reopenedUser.Tags, users[0].Tags)
 	}
 
+	if _, err := reopened.CreateAccessKey(ctx, CreateAccessKeyInput{
+		UserName:        "zoe",
+		AccessKeyID:     "AKIAZZZZZZZZZZZZZZZZ",
+		SecretAccessKey: "secret",
+		Status:          "Active",
+		CreateDate:      created,
+	}); err != nil {
+		t.Fatalf("CreateAccessKey: %v", err)
+	}
+	if err := reopened.DeleteUser(ctx, "zoe"); !errors.Is(err, iamerr.GetAPIError(iamerr.ErrDeleteConflict)) {
+		t.Fatalf("DeleteUser with access keys err = %v, want DeleteConflict", err)
+	}
+	if err := reopened.DeleteAccessKey(ctx, "zoe", "AKIAZZZZZZZZZZZZZZZZ"); err != nil {
+		t.Fatalf("DeleteAccessKey: %v", err)
+	}
+
 	if err := reopened.DeleteUser(ctx, "zoe"); err != nil {
 		t.Fatalf("DeleteUser: %v", err)
 	}

iamapi/storage/vault.go

@@ -20,6 +20,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -228,9 +229,13 @@ func (s *VaultStore) CreateUser(_ context.Context, user types.User) (*types.User
 }
 
 func (s *VaultStore) DeleteUser(ctx context.Context, username string) error {
-	if _, err := s.GetUser(ctx, username); err != nil {
+	user, err := s.GetUser(ctx, username)
+	if err != nil {
 		return err
 	}
+	if len(user.AccessKeys) > 0 {
+		return iamerr.GetAPIError(iamerr.ErrDeleteConflict)
+	}
 	return s.deleteByPath(username)
 }
 
@@ -366,17 +371,186 @@ func (s *VaultStore) UpdateUser(ctx context.Context, input UpdateUserInput) (*ty
 		if err := s.deleteByPath(input.UserName); err != nil {
 			return nil, err
 		}
-	} else {
-		// Delete all versions then re-create so CAS=0 succeeds.
-		if err := s.deleteByPath(input.UserName); err != nil {
-			return nil, err
+	} else if _, err := s.replaceUser(ctx, *user); err != nil {
+		return nil, err
+	}
+
+	return cloneUser(*user), nil
+}
+
+// replaceUser overwrites the stored document for user.UserName by deleting
+// all existing versions and recreating with CAS=0.
+func (s *VaultStore) replaceUser(ctx context.Context, user types.User) (*types.User, error) {
+	if err := s.deleteByPath(user.UserName); err != nil {
+		return nil, err
+	}
+	return s.CreateUser(ctx, user)
+}
+
+func (s *VaultStore) CreateAccessKey(ctx context.Context, input CreateAccessKeyInput) (*types.AccessKey, error) {
+	user, err := s.GetUser(ctx, input.UserName)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(user.AccessKeys) >= MaxAccessKeysPerUser {
+		return nil, iamerr.AccessKeysLimitExceeded(MaxAccessKeysPerUser)
+	}
+	for _, key := range user.AccessKeys {
+		if key.AccessKeyId == input.AccessKeyID {
+			return nil, ErrAccessKeyIDAlreadyExists
 		}
-		if _, err := s.CreateUser(ctx, *user); err != nil {
+	}
+
+	user.AccessKeys = append(user.AccessKeys, types.AccessKeyEntry{
+		AccessKeyId:     input.AccessKeyID,
+		SecretAccessKey: input.SecretAccessKey,
+		Status:          input.Status,
+		CreateDate:      input.CreateDate,
+	})
+
+	if _, err := s.replaceUser(ctx, *user); err != nil {
+		return nil, err
+	}
+
+	return &types.AccessKey{
+		UserName:        input.UserName,
+		AccessKeyId:     input.AccessKeyID,
+		Status:          input.Status,
+		SecretAccessKey: input.SecretAccessKey,
+		CreateDate:      input.CreateDate,
+	}, nil
+}
+
+func (s *VaultStore) UpdateAccessKey(ctx context.Context, input UpdateAccessKeyInput) error {
+	user, err := s.GetUser(ctx, input.UserName)
+	if err != nil {
+		return err
+	}
+
+	found := false
+	for i, key := range user.AccessKeys {
+		if key.AccessKeyId == input.AccessKeyID {
+			user.AccessKeys[i].Status = input.Status
+			found = true
+			break
+		}
+	}
+	if !found {
+		return iamerr.NoSuchEntityAccessKey(input.AccessKeyID)
+	}
+
+	_, err = s.replaceUser(ctx, *user)
+	return err
+}
+
+func (s *VaultStore) DeleteAccessKey(ctx context.Context, username, accessKeyID string) error {
+	user, err := s.GetUser(ctx, username)
+	if err != nil {
+		return err
+	}
+
+	idx := -1
+	for i, key := range user.AccessKeys {
+		if key.AccessKeyId == accessKeyID {
+			idx = i
+			break
+		}
+	}
+	if idx == -1 {
+		return iamerr.NoSuchEntityAccessKey(accessKeyID)
+	}
+
+	user.AccessKeys = slices.Delete(user.AccessKeys, idx, idx+1)
+
+	_, err = s.replaceUser(ctx, *user)
+	return err
+}
+
+func (s *VaultStore) GetAccessKeyLastUsed(ctx context.Context, accessKeyID string) (*GetAccessKeyLastUsedOutput, error) {
+	resp, err := s.client.Secrets.KvV2List(context.Background(), s.secretStoragePath, s.kvReqOpts...)
+	if err != nil {
+		if vault.IsErrorStatus(err, http.StatusNotFound) {
+			return nil, iamerr.NoSuchEntityAccessKey(accessKeyID)
+		}
+		if reauthErr := s.reAuthIfNeeded(err); reauthErr != nil {
+			return nil, reauthErr
+		}
+		resp, err = s.client.Secrets.KvV2List(context.Background(), s.secretStoragePath, s.kvReqOpts...)
+		if err != nil {
+			if vault.IsErrorStatus(err, http.StatusNotFound) {
+				return nil, iamerr.NoSuchEntityAccessKey(accessKeyID)
+			}
 			return nil, err
 		}
 	}
 
-	return cloneUser(*user), nil
+	for _, username := range resp.Data.Keys {
+		user, err := s.GetUser(ctx, username)
+		if err != nil {
+			return nil, err
+		}
+		for _, key := range user.AccessKeys {
+			if key.AccessKeyId == accessKeyID {
+				return &GetAccessKeyLastUsedOutput{
+					UserName:     username,
+					LastUsedDate: key.LastUsedDate,
+					ServiceName:  key.LastUsedService,
+					Region:       key.LastUsedRegion,
+				}, nil
+			}
+		}
+	}
+
+	return nil, iamerr.NoSuchEntityAccessKey(accessKeyID)
+}
+
+func (s *VaultStore) ListAccessKeys(ctx context.Context, input ListAccessKeysInput) (*ListAccessKeysOutput, error) {
+	user, err := s.GetUser(ctx, input.UserName)
+	if err != nil {
+		return nil, err
+	}
+
+	keys := make([]types.AccessKeyMetadata, 0, len(user.AccessKeys))
+	for _, key := range user.AccessKeys {
+		keys = append(keys, types.AccessKeyMetadata{
+			UserName:    input.UserName,
+			AccessKeyId: key.AccessKeyId,
+			Status:      key.Status,
+			CreateDate:  key.CreateDate,
+		})
+	}
+	sort.Slice(keys, func(i, j int) bool {
+		return keys[i].AccessKeyId < keys[j].AccessKeyId
+	})
+
+	start := 0
+	if input.Marker != "" {
+		start = len(keys)
+		for i, key := range keys {
+			if key.AccessKeyId == input.Marker {
+				start = i + 1
+				break
+			}
+		}
+	}
+	keys = keys[start:]
+
+	limit := len(keys)
+	if input.MaxItems > 0 && int(input.MaxItems) < limit {
+		limit = int(input.MaxItems)
+	}
+
+	out := &ListAccessKeysOutput{
+		AccessKeys: make([]types.AccessKeyMetadata, limit),
+	}
+	copy(out.AccessKeys, keys[:limit])
+	if limit < len(keys) {
+		out.IsTruncated = true
+		out.Marker = out.AccessKeys[limit-1].AccessKeyId
+	}
+
+	return out, nil
 }
 
 // deleteByPath permanently removes a secret and all its versions without

iamapi/types/access_key.go

@@ -0,0 +1,121 @@
+// Copyright 2026 Versity Software
+// This file is licensed under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package types
+
+import (
+	"encoding/xml"
+	"time"
+)
+
+type CreateAccessKeyResponse struct {
+	XMLName          xml.Name              `xml:"https://iam.amazonaws.com/doc/2010-05-08/ CreateAccessKeyResponse"`
+	Result           CreateAccessKeyResult `xml:"CreateAccessKeyResult"`
+	ResponseMetadata ResponseMetadata
+}
+
+func (r *CreateAccessKeyResponse) SetRequestID(requestID string) {
+	r.ResponseMetadata.RequestID = requestID
+}
+
+type CreateAccessKeyResult struct {
+	AccessKey AccessKey
+}
+
+type AccessKey struct {
+	UserName        string `xml:",omitempty"`
+	AccessKeyId     string
+	Status          string
+	SecretAccessKey string
+	CreateDate      time.Time
+}
+
+type UpdateAccessKeyResponse struct {
+	XMLName          xml.Name `xml:"https://iam.amazonaws.com/doc/2010-05-08/ UpdateAccessKeyResponse"`
+	ResponseMetadata ResponseMetadata
+}
+
+func (r *UpdateAccessKeyResponse) SetRequestID(requestID string) {
+	r.ResponseMetadata.RequestID = requestID
+}
+
+type DeleteAccessKeyResponse struct {
+	XMLName          xml.Name `xml:"https://iam.amazonaws.com/doc/2010-05-08/ DeleteAccessKeyResponse"`
+	ResponseMetadata ResponseMetadata
+}
+
+func (r *DeleteAccessKeyResponse) SetRequestID(requestID string) {
+	r.ResponseMetadata.RequestID = requestID
+}
+
+type GetAccessKeyLastUsedResponse struct {
+	XMLName          xml.Name                   `xml:"https://iam.amazonaws.com/doc/2010-05-08/ GetAccessKeyLastUsedResponse"`
+	Result           GetAccessKeyLastUsedResult `xml:"GetAccessKeyLastUsedResult"`
+	ResponseMetadata ResponseMetadata
+}
+
+func (r *GetAccessKeyLastUsedResponse) SetRequestID(requestID string) {
+	r.ResponseMetadata.RequestID = requestID
+}
+
+type GetAccessKeyLastUsedResult struct {
+	UserName          string `xml:",omitempty"`
+	AccessKeyLastUsed AccessKeyLastUsed
+}
+
+type AccessKeyLastUsed struct {
+	LastUsedDate *time.Time `xml:",omitempty"`
+	ServiceName  string
+	Region       string
+}
+
+type ListAccessKeysResponse struct {
+	XMLName          xml.Name             `xml:"https://iam.amazonaws.com/doc/2010-05-08/ ListAccessKeysResponse"`
+	Result           ListAccessKeysResult `xml:"ListAccessKeysResult"`
+	ResponseMetadata ResponseMetadata
+}
+
+func (r *ListAccessKeysResponse) SetRequestID(requestID string) {
+	r.ResponseMetadata.RequestID = requestID
+}
+
+type ListAccessKeysResult struct {
+	AccessKeyMetadata AccessKeyMetadataList
+	IsTruncated       bool
+	Marker            string `xml:",omitempty"`
+}
+
+type AccessKeyMetadataList struct {
+	Members []AccessKeyMetadata `xml:"member"`
+}
+
+type AccessKeyMetadata struct {
+	UserName    string `xml:",omitempty"`
+	AccessKeyId string
+	Status      string
+	CreateDate  time.Time
+}
+
+// AccessKeyEntry is the storage representation of an access key belonging to
+// a User. It is never marshaled to XML directly; it round-trips through JSON
+// for the internal and Vault storers.
+type AccessKeyEntry struct {
+	AccessKeyId     string
+	SecretAccessKey string
+	Status          string
+	CreateDate      time.Time
+	LastUsedDate    time.Time
+	LastUsedService string
+	LastUsedRegion  string
+}

iamapi/types/user.go

@@ -99,12 +99,13 @@ func (r *DeleteUserResponse) SetRequestID(requestID string) {
 }
 
 type User struct {
-	Path       string    `xml:",omitempty"`
-	UserName   string    `xml:",omitempty"`
-	UserID     string    `xml:"UserId"`
-	Arn        string    `xml:"Arn"`
-	CreateDate time.Time `xml:"CreateDate"`
-	Tags       []Tag     `xml:"Tags>member,omitempty"`
+	Path       string           `xml:",omitempty"`
+	UserName   string           `xml:",omitempty"`
+	UserID     string           `xml:"UserId"`
+	Arn        string           `xml:"Arn"`
+	CreateDate time.Time        `xml:"CreateDate"`
+	Tags       []Tag            `xml:"Tags>member,omitempty"`
+	AccessKeys []AccessKeyEntry `xml:"-"`
 }
 
 type Tag struct {