Description

Ensure that every active access key of every IAM user was created or rotated within the last 90 days. Access keys are long-term credentials used for programmatic access to AWS, and each IAM user can have up to two of them. Inactive keys are not evaluated.

Rationale

The longer an access key stays valid, the longer it can be abused if it is leaked in source code, logs or tools. An unrotated key that has been exposed can be used for unauthorized API calls, data theft, resource changes and unexpected costs. Rotating keys at least every 90 days limits this window. Where possible, IAM roles with temporary credentials should be used instead of long-term access keys.

Impact

  • Limits how long a leaked or stolen access key can be used

  • Every application, script or tool that uses the old key must be updated with the new key before the old key is deactivated, or it will stop working

  • Unused keys found during the review can be removed, reducing the number of long-term credentials

Default Value

A newly created IAM user has no access keys. AWS does not rotate or expire access keys automatically.

Pre-Requisites

  • IAM permissions: iam:ListUsers, iam:ListAccessKeys, iam:GetAccessKeyLastUsed, iam:CreateAccessKey, iam:UpdateAccessKey and iam:DeleteAccessKey

  • A list of the applications and people that use each access key, and a way to update the key in each of them

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Credential report in the left menu.

  3. Download the report and review the access_key_1_active, access_key_1_last_rotated, access_key_2_active and access_key_2_last_rotated columns for each user.

  4. If any active key was last rotated more than 90 days ago, follow the implementation steps.

CLI:

List all IAM users:

aws iam list-users --query "Users[].UserName" --output table

For each user, list the access keys with their status and creation date:

aws iam list-access-keys --user-name <USER_NAME> --query "AccessKeyMetadata[].[AccessKeyId,Status,CreateDate]" --output table

A key fails if its status is Active and it was created or last rotated more than 90 days ago. Each failing key is reported separately.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Users in the left menu.

  3. Select the affected user and open the Security credentials tab.

  4. If the user has only one access key, choose Create access key and save the new key securely.

  5. Update every application, script or tool that uses the old key with the new key.

  6. In Access keys, select the old key and choose Actions, then Deactivate.

  7. After confirming that nothing still uses the old key (check Last used), choose Actions, then Delete.

  8. Repeat for each affected access key.

CLI:

Create a new access key for the user:

aws iam create-access-key --user-name <USER_NAME>

After updating all applications with the new key, deactivate the old key:

aws iam update-access-key --user-name <USER_NAME> --access-key-id <OLD_ACCESS_KEY_ID> --status Inactive

Check when the old key was last used:

aws iam get-access-key-last-used --access-key-id <OLD_ACCESS_KEY_ID>

When the old key is no longer needed, delete it:

aws iam delete-access-key --user-name <USER_NAME> --access-key-id <OLD_ACCESS_KEY_ID>

Deactivating the old key without first creating and distributing a new one (as some guides suggest) stops every application that uses it, so create the new key first.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console, select Users in the left menu and select the user.

  3. On the Security credentials tab, select the old access key and choose Actions, then Activate.

CLI:

aws iam update-access-key --user-name <USER_NAME> --access-key-id <OLD_ACCESS_KEY_ID> --status Active

Note: a deleted access key cannot be restored, so keep the old key inactive until the new key is confirmed to work. Reactivating an old key restores the risk of long-lived credentials.

Reference