feat: add IAM user access key management

Add `CreateAccessKey`, `UpdateAccessKey`, `DeleteAccessKey`, `ListAccessKeys`, and `GetAccessKeyLastUsed` actions for managing user access keys and retrieving their latest usage details.

Generate AWS-style access key IDs and secrets, validate key identifiers and statuses, enforce per-user key quotas, and prevent deleting users that still own access keys. Persist access keys across internal and Vault storage backends with ownership indexing, pagination, and IAM-compatible errors and XML responses.

iamapi/internal/iamutil/access_key.go

@@ -0,0 +1,88 @@
+// Copyright 2026 Versity Software
+// This file is licensed under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package iamutil
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"regexp"
+
+	"github.com/versity/versitygw/debuglogger"
+	"github.com/versity/versitygw/iamapi/iamerr"
+)
+
+const (
+	AccessKeyStatusActive   = "Active"
+	AccessKeyStatusInactive = "Inactive"
+
+	accessKeyIDPrefix    = "AKIA"
+	accessKeyIDRandomLen = 17
+	minAccessKeyIDLen    = 16
+	maxAccessKeyIDLen    = 128
+	secretAccessKeyBytes = 30
+)
+
+var accessKeyIDPattern = regexp.MustCompile(`^[\w]+$`)
+
+// GenerateAccessKeyID returns a new cryptographically random IAM access key
+// id in the AKIA… format.
+func GenerateAccessKeyID() (string, error) {
+	id, err := generateAWSID(accessKeyIDPrefix, accessKeyIDRandomLen)
+	if err != nil {
+		debuglogger.Logf("failed to generate IAM access key id: %v", err)
+		return "", err
+	}
+	return id, nil
+}
+
+// GenerateSecretAccessKey returns a new cryptographically random 40 character
+// secret access key.
+func GenerateSecretAccessKey() (string, error) {
+	b := make([]byte, secretAccessKeyBytes)
+	if _, err := rand.Read(b); err != nil {
+		debuglogger.Logf("failed to generate IAM secret access key: %v", err)
+		return "", err
+	}
+	return base64.StdEncoding.EncodeToString(b), nil
+}
+
+// ValidateAccessKeyID checks that accessKeyID fits within the allowed length
+// range and character set.
+func ValidateAccessKeyID(accessKeyID string) error {
+	if len(accessKeyID) < minAccessKeyIDLen {
+		debuglogger.Logf("IAM access key id too short: value=%q", accessKeyID)
+		return iamerr.AccessKeyIDTooShort(minAccessKeyIDLen)
+	}
+	if len(accessKeyID) > maxAccessKeyIDLen {
+		debuglogger.Logf("IAM access key id too long: value=%q", accessKeyID)
+		return iamerr.AccessKeyIDTooLong(maxAccessKeyIDLen)
+	}
+	if !accessKeyIDPattern.MatchString(accessKeyID) {
+		debuglogger.Logf("invalid IAM access key id characters: value=%q", accessKeyID)
+		return iamerr.GetAPIError(iamerr.ErrInvalidAccessKeyIDChars)
+	}
+
+	return nil
+}
+
+// ValidateAccessKeyStatus checks that status is either Active or Inactive.
+func ValidateAccessKeyStatus(status string) error {
+	if status != AccessKeyStatusActive && status != AccessKeyStatusInactive {
+		debuglogger.Logf("invalid IAM access key status: %q", status)
+		return iamerr.InvalidAccessKeyStatus(status)
+	}
+
+	return nil
+}

iamapi/internal/iamutil/user.go

@@ -151,15 +151,25 @@ func BuildUserArn(accountID, path, userName string) string {
 
 // GenerateUserID returns a new cryptographically random IAM user ID in the AIDA… format.
 func GenerateUserID() (string, error) {
+	id, err := generateAWSID(userIDPrefix, userIDRandomLen)
+	if err != nil {
+		debuglogger.Logf("failed to generate IAM user ID: %v", err)
+		return "", err
+	}
+	return id, nil
+}
+
+// generateAWSID builds an AWS-style unique identifier: a fixed prefix
+// followed by randomLen characters drawn from userIDAlphabet.
+func generateAWSID(prefix string, randomLen int) (string, error) {
 	var b strings.Builder
-	b.Grow(len(userIDPrefix) + userIDRandomLen)
-	b.WriteString(userIDPrefix)
+	b.Grow(len(prefix) + randomLen)
+	b.WriteString(prefix)
 
 	max := big.NewInt(int64(len(userIDAlphabet)))
-	for range userIDRandomLen {
+	for range randomLen {
 		n, err := rand.Int(rand.Reader, max)
 		if err != nil {
-			debuglogger.Logf("failed to generate IAM user ID: %v", err)
 			return "", err
 		}
 		b.WriteByte(userIDAlphabet[n.Int64()])