Description

Ensure every active API signing key belonging to an IAM user was created within the last 90 days. API keys are used by the OCI CLI, SDKs, and automation to sign requests, so they should be replaced regularly and the old key removed after the switch.

Rationale

API keys remain valid until they are deleted. A private key that is never replaced may be copied to many machines, repositories, or CI systems over time, and anyone who obtains it can act as that user. Rotating keys at least every 90 days limits how long a leaked key can be used and forces a regular review of where keys are stored.

Impact

  • Limits how long a leaked API key can be used

  • Encourages review of where keys are stored

  • Tools using the old key must be updated

Default Value

By default, API keys do not expire, and each user can have up to three API keys.

Pre-Requisites

  • Identity domain administrator or user administrator role, or the user themselves

  • A list of tools and machines that use each key

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the User management tab, and select the user you want to review.

  4. Open the Tokens and keys tab and find the API keys section (on older consoles, select API keys under Resources).

  5. Check the creation date of each key.

  6. If any active key is older than 90 days, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the User management tab, and select the user you want to review.

  4. Open the Tokens and keys tab, and in the API keys section select Add API key.

  5. Generate or upload a new key pair and select Add.

  6. Update the OCI CLI configuration and every tool that uses the old key with the new key and fingerprint.

  7. Delete the old API key.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the User management tab, and select the user you want to review.

  4. If a tool fails, add another new API key and update the tool with it.

Reference