Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

This guide documents the new AWS Wickr administration console, released on March 13, 2025. For documentation on the classic version of the AWS Wickr administration console, see Classic Administration Guide.

Password recovery instruction

Overview

During the Data Retention account generation flow, if the service detects an already configured Data Retention Bot, but no serverless data retention, a password collection script (collect.py) is uploaded to your S3 bucket. You need to download and run this script locally to provide your Wickr Data Retention password so the service can recover your bot's identity.

Before running the script, verify that your IAM role or user has the required permissions on the password recovery key and S3 bucket. See the Password Recovery Key Policy section below to configure access.

Password recovery key policy

To run the password recovery script, the IAM principal executing it requires the following permissions:

Finding your resource ARNs

If your password recovery key was generated by the product, you can find the key ARN in the Service Catalog outputs:

Adding the required permission

Add the following statement to the password recovery KMS key policy. Replace {your-role-or-user-arn} with the ARN of the IAM role or user that will execute the script.

{
  "Sid": "PasswordRecoveryScriptAccess",
  "Effect": "Allow",
  "Principal": { "AWS": "{your-role-or-user-arn}" },
  "Action": "kms:GetPublicKey",
  "Resource": "*"
}

The same principal also needs s3:PutObject on the data retention DRS S3 bucket. Grant this through an IAM identity policy attached to the role or user.

Python script guide

The script requires:

Windows

Install Python

Install dependencies

Open Command Prompt or PowerShell and run:

pip install boto3 cryptography

Configure AWS credentials

Make sure your AWS credentials are configured. The simplest approach is to use the AWS CLI:

aws configure

Provide your Access Key ID, Secret Access Key, and default region. The credentials must have:

Download and extract the script

Run the script

python collect.py

After successful completion, delete the local files:

del collect.py config.json collect.zip

macOS

Install Python

macOS ships with a system Python, but it may be outdated. Install a current version using one of these methods:

Option A: Official installer (simplest)

Option B: Homebrew

If you have Homebrew installed:

brew install python@3.12

Verify:

python3 --version

Install dependencies

pip3 install boto3 cryptography

If you get a permissions error, use:

pip3 install --user boto3 cryptography

Configure AWS credentials

aws configure

Provide your Access Key ID, Secret Access Key, and default region. The credentials must have:

Download and extract the script

Run the script

python3 collect.py

After successful completion, delete the local files:

rm collect.py config.json collect.zip

Linux

Install Python

Most Linux distributions include Python 3. Check your current version:

python3 --version

If Python is not installed or is below 3.8, install it using your distribution's package manager:

Ubuntu / Debian

sudo apt update
sudo apt install python3 python3-pip

Amazon Linux 2023 / Fedora / RHEL 9+

sudo dnf install python3 python3-pip

Amazon Linux 2 / RHEL 7-8 / CentOS 7-8

sudo yum install python3 python3-pip

Verify:

python3 --version
pip3 --version

Install dependencies

pip3 install boto3 cryptography

If you get a permissions error, use:

pip3 install --user boto3 cryptography

Configure AWS credentials

aws configure

Provide your Access Key ID, Secret Access Key, and default region. The credentials must have:

Download and extract the script

Run the script

python3 collect.py

After successful completion, delete the local files:

rm collect.py config.json collect.zip