All checks
Medium
IAM users' access keys should be rotated every 90 days or less
Checks that each active IAM user access key is no more than 90 days old, counted from its creation because IAM records no rotation date. Rotation limits how long a leaked key stays usable; an inactive key is not judged, so deactivating an old one clears its finding.
- service
- IAM
- severity
- Medium
- scope
- evaluated once per account
How to fix it
- Can break clients: Anything still using the old key fails once it is inactive, so first create a second key and move every application and tool onto it.
In the console
IAM → Users → the user → Security credentials → Access keys
- Status
- Inactive on the old key (Actions → Deactivate, reversible); later delete it: inactive keys count toward a two-key limit
With the AWS CLI
aws iam update-access-key --user-name <user-name> --access-key-id <access-key-id> --status InactiveSee which of your accounts this check is failing on.
Book a live scan