# Ensure access keys are rotated every 90 days or less - Source: https://support.icompaas.com/support/solutions/articles/a_1793292216123318-ensure-access-keys-are-rotated-every-90-days-or-less - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every active access key of every IAM user was created or rotated within the last 90 days. Access keys are long-term credentials used for programmatic access to AWS, and each IAM user can have up to two of them. Inactive keys are not evaluated. **Rationale** The longer an access key stays valid, the longer it can be abused if it is leaked in source code, logs or tools. An unrotated key that has been exposed can be used for unauthorized API calls, data theft, resource changes and unexpected costs. Rotating keys at least every 90 days limits this window. Where possible, IAM roles with temporary credentials should be used instead of long-term access keys. **Impact** - Limits how long a leaked or stolen access key can be used - Every application, script or tool that uses the old key must be updated with the new key before the old key is deactivated, or it will stop working - Unused keys found during the review can be removed, reducing the number of long-term credentials **Default Value** A newly created IAM user has no access keys. AWS does not rotate or expire access keys automatically. **Pre-Requisites** - IAM permissions: iam:ListUsers, iam:ListAccessKeys, iam:GetAccessKeyLastUsed, iam:CreateAccessKey, iam:UpdateAccessKey and iam:DeleteAccessKey - A list of the applications and people that use each access key, and a way to update the key in each of them **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the IAM console and select **Credential report** in the left menu. 3. Download the report and review the access\_key\_1\_active, access\_key\_1\_last\_rotated, access\_key\_2\_active and access\_key\_2\_last\_rotated columns for each user. 4. If any active key was last rotated more than 90 days ago, follow the implementation steps. **CLI:** List all IAM users: aws iam list-users --query "Users\[\].UserName" --output table For each user, list the access keys with their status and creation date: aws iam list-access-keys --user-name --query "AccessKeyMetadata\[\].\[AccessKeyId,Status,CreateDate\]" --output table A key fails if its status is Active and it was created or last rotated more than 90 days ago. Each failing key is reported separately. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the IAM console and select **Users** in the left menu. 3. Select the affected user and open the **Security credentials** tab. 4. If the user has only one access key, choose **Create access key** and save the new key securely. 5. Update every application, script or tool that uses the old key with the new key. 6. In **Access keys**, select the old key and choose **Actions**, then **Deactivate**. 7. After confirming that nothing still uses the old key (check **Last used**), choose **Actions**, then **Delete**. 8. Repeat for each affected access key. **CLI:** Create a new access key for the user: aws iam create-access-key --user-name After updating all applications with the new key, deactivate the old key: aws iam update-access-key --user-name --access-key-id --status Inactive Check when the old key was last used: aws iam get-access-key-last-used --access-key-id When the old key is no longer needed, delete it: aws iam delete-access-key --user-name --access-key-id Deactivating the old key without first creating and distributing a new one (as some guides suggest) stops every application that uses it, so create the new key first. **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the IAM console, select **Users** in the left menu and select the user. 3. On the **Security credentials** tab, select the old access key and choose **Actions**, then **Activate**. **CLI:** aws iam update-access-key --user-name --access-key-id --status Active Note: a deleted access key cannot be restored, so keep the old key inactive until the new key is confirmed to work. Reactivating an old key restores the risk of long-lived credentials. **Reference** - [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_credentials\_access-keys.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) - [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_credentials\_getting-report.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html) - [https://docs.aws.amazon.com/cli/latest/reference/iam/update-access-key.html](https://docs.aws.amazon.com/cli/latest/reference/iam/update-access-key.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.