How to find and rotate stale IAM access keys

The credential report is a single CSV covering every IAM user in the account — password age, MFA status, and both access keys with their last-rotated and last-used dates. Generate it, then download and decode it:

aws iam generate-credential-report
aws iam get-credential-report \
  --query 'Content' --output text | base64 --decode > credential-report.csv

The columns that matter for keys are access_key_1_active, access_key_1_last_rotated, access_key_1_last_used_date (and the matching _2_ set). In the console the same view lives under IAM → Users → Security credentials → Access keys, which shows a "Last used" timestamp per key.

A key is stale if last_rotated is more than 90 days ago, if it has never been used, or if it belongs to a user with no recent activity. For a specific key, confirm the last service and region it touched before you act:

aws iam list-access-keys --user-name ci-deployer
aws iam get-access-key-last-used --access-key-id AKIAEXAMPLE0000

If LastUsedDate is absent, the key has never made a signed request — deactivate and delete it rather than rotating. Sort your CSV by access_key_1_last_rotated to work oldest-first.

IAM allows two access keys per user precisely so you can rotate with an overlap and never take an outage. Never delete the old key first — deactivate it, verify, then delete.

# 1. Create the replacement key (note the SecretAccessKey — shown once)
aws iam create-access-key --user-name ci-deployer

# 2. Deploy the new key everywhere the old one is referenced
#    (CI secrets, ~/.aws/credentials, app config, cron/scripts)

# 3. Deactivate — do NOT delete — the old key
aws iam update-access-key --user-name ci-deployer \
  --access-key-id AKIAEXAMPLE0000 --status Inactive

# 4. Watch last-used for a few days to catch anything you missed
aws iam get-access-key-last-used --access-key-id AKIAEXAMPLE0000

# 5. Once confirmed idle, delete it
aws iam delete-access-key --user-name ci-deployer \
  --access-key-id AKIAEXAMPLE0000

If something breaks in step 3, set the old key back to Active instantly — that is the whole point of deactivating rather than deleting.

The root user should have zero long-lived access keys. A root key cannot be scoped down, so a single leak is game over for the whole account. You cannot manage root keys with an IAM principal — sign in as root, open My Security Credentials, and delete any access keys under Access keys (root). Then enable MFA on root and lock the credentials away. Everyday work moves to IAM roles or IAM Identity Center users.

Rotation is a chore you repeat forever; the durable fix is to stop issuing static keys at all. STS hands out short-lived credentials that expire on their own, so there is nothing to leak long-term:

• Workloads on AWS

  Attach an IAM role to the EC2 instance, ECS task, or Lambda function and remove the static keys entirely — the SDK fetches temporary credentials from the instance/task metadata automatically.
• People

  Move humans to IAM Identity Center (SSO). aws sso login mints short-lived credentials per session; no access key ever lands on a laptop.
• CI/CD outside AWS

  Use OIDC federation (sts:AssumeRoleWithWebIdentity) so your pipeline assumes a role with a signed identity token instead of a stored key — e.g. a GitHub Actions or GitLab job with no long-lived secret at all.

AWS does not expire keys for you, but two AWS Config managed rules give you continuous drift detection so a stale key gets flagged the day it crosses the line — not at the next audit. The Terraform below turns on access-keys-rotated with a 90-day age; pair it with iam-user-unused-credentials-check for dormant users:

resource "aws_config_config_rule" "access_keys_rotated" {
  name = "access-keys-rotated"

  source {
    owner             = "AWS"
    source_identifier = "ACCESS_KEYS_ROTATED"
  }

  input_parameters = jsonencode({ maxAccessKeyAge = "90" })
}

Config must be recording in the region for the rule to evaluate. This flags drift — it does not rotate anything for you; the two-key workflow above is still how you remediate.