All checks
Medium
IAM users' access keys should be rotated every 90 days or less
Checks that each active IAM user access key is no more than 90 days old, counted from its creation because IAM records no rotation date. Rotation limits how long a leaked key stays usable; an inactive key is not judged, so deactivating an old one clears its finding.
- service
- IAM
- severity
- Medium
- scope
- evaluated once per account
How to fix it
In the console
IAM → Users → the user → Security credentials → Access keys
With the AWS CLI
aws iam update-access-key --user-name <user-name> --access-key-id <access-key-id> --status InactiveSee which of your accounts this check is failing on.
Book a demo