Check Details

• Resource: Users
• Check: Enforce key rotation
• Risk: Long-lived access keys increase the risk of unauthorized access

Remediation via AWS Console

1. Sign in to the AWS Management Console and open the IAM console.
2. Click Users and select the IAM user.
3. Open the Security credentials tab.
4. Under Access keys, identify keys older than 90 days using the Created and Last used fields.
5. Click Actions next to the access key and choose Make inactive.

   Note: Administrators should deactivate keys older than 90 days. IAM users should deactivate or delete keys that have not been rotated or used in 90 days.

6. Click Create access key. Select Command Line Interface (CLI) as the use case and click Next.
7. Click Create access key.
8. Update all applications and scripts to use the new access key credentials.

Remediation via AWS CLI

1. Log in to the AWS Management Console and click the CloudShell icon (>_) in the top-right corner.
2. Create a new access key for the IAM user:

   
   
   aws iam create-access-key --user-name <iam_user>
   

3. Update applications to use the new access key.
4. Check if the old access key is still being used:

   
   
   aws iam get-access-key-last-used --access-key-id <old_access_key_id>
   

5. Wait for some time and recheck usage:

   
   
   aws iam get-access-key-last-used --access-key-id <old_access_key_id>
   

   If LastUsedDate does not change, the key is no longer in use.

6. Disable or delete the old access key:

   
   
   aws iam delete-access-key \
    --user-name <iam_user> \
    --access-key-id <iam_access_key_id>