# Ensure user customer secret key is rotated within 90 days or less

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698517790850-ensure-user-customer-secret-key-is-rotated-within-90-days-or-less
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure every customer secret key belonging to an IAM user was created within the last 90 days. Customer secret keys are access key and secret pairs used with the Object Storage Amazon S3 Compatibility API, so they should be replaced regularly and the old key deleted after the switch.

**Rationale**

Customer secret keys work like long-lived S3 access keys and remain valid until they are deleted. They are often stored in application configuration or backup tools, where they can leak. Rotating them at least every 90 days limits how long a leaked key could be used to read or change data in Object Storage.

**Impact**

-   Limits how long a leaked S3-compatible key can be used
    
-   Removes old keys that may be stored insecurely
    
-   Applications using the old key must be updated
    

**Default Value**

By default, customer secret keys do not expire, and each user can have up to two keys.

**Pre-Requisites**

-   Identity domain administrator or user administrator role
    
-   A list of applications that use each key
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the User management tab, and select the user you want to review.
    
4.  Open the Tokens and keys tab and find the Customer secret keys section (on older consoles, select Customer secret keys under Resources).
    
5.  Check the creation date of each key.
    
6.  If any key is older than 90 days, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the User management tab, and select the user you want to review.
    
4.  Open the Tokens and keys tab, and in the Customer secret keys section select Generate secret key.
    
5.  Enter a name, select Generate secret key, and copy the secret immediately, as it is shown only once.
    
6.  Update every application that uses the old key with the new access key and secret.
    
7.  Delete the old customer secret key.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the User management tab, and select the user you want to review.
    
4.  If an application fails, generate another secret key and update the application with it.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingcredentials.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingcredentials.htm)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.