Check provider logo

IAM user does not have active access keys older than 90 days

iam_rotate_access_key_90_days

Severitymedium
Serviceiam
by Prowler
secrets

IAM user access keys are assessed via the credential report. For each active key, the last_rotated timestamp is compared to 90 days; keys exceeding this age are identified. Users without keys or with only recent rotations are noted.

Risk

Long-lived access keys widen the attack window. If a key is leaked in code, logs, or tooling, lack of rotation keeps it valid for abuse, enabling unauthorized API calls, data exfiltration, and tampering. This degrades confidentiality and integrity and can impact availability and cost through destructive or excessive operations.

Run this check with Prowler CLI

prowler aws --checks iam_rotate_access_key_90_days

Run in Prowler Cloud

Recommendation

Apply least privilege and limit static credentials:

  • Rotate active access keys at or before 90 days
  • Prefer IAM roles with short-lived tokens
  • Maintain only one active key during rotation; delete the old one
  • Monitor last_used and remove dormant keys
  • Automate alerts and periodic reviews of key age

Remediation

CLI

aws iam update-access-key --user-name <USER_NAME> --access-key-id <ACCESS_KEY_ID> --status Inactive

Terraform
Other
  1. Open the IAM console and go to Users
  2. Select the affected user
  3. Open the Security credentials tab
  4. Under Access keys, find any key older than 90 days
  5. Click Actions > Deactivate (or Delete) for that key
  6. Repeat for any other active keys older than 90 days

Source Code

Resource Type

AwsIamUser

References