Description

Ensure every customer secret key belonging to an IAM user was created within the last 90 days. Customer secret keys are access key and secret pairs used with the Object Storage Amazon S3 Compatibility API, so they should be replaced regularly and the old key deleted after the switch.

Rationale

Customer secret keys work like long-lived S3 access keys and remain valid until they are deleted. They are often stored in application configuration or backup tools, where they can leak. Rotating them at least every 90 days limits how long a leaked key could be used to read or change data in Object Storage.

Impact

  • Limits how long a leaked S3-compatible key can be used

  • Removes old keys that may be stored insecurely

  • Applications using the old key must be updated

Default Value

By default, customer secret keys do not expire, and each user can have up to two keys.

Pre-Requisites

  • Identity domain administrator or user administrator role

  • A list of applications that use each key

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the User management tab, and select the user you want to review.

  4. Open the Tokens and keys tab and find the Customer secret keys section (on older consoles, select Customer secret keys under Resources).

  5. Check the creation date of each key.

  6. If any key is older than 90 days, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the User management tab, and select the user you want to review.

  4. Open the Tokens and keys tab, and in the Customer secret keys section select Generate secret key.

  5. Enter a name, select Generate secret key, and copy the secret immediately, as it is shown only once.

  6. Update every application that uses the old key with the new access key and secret.

  7. Delete the old customer secret key.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the User management tab, and select the user you want to review.

  4. If an application fails, generate another secret key and update the application with it.

Reference