How to Rotate AWS Access Keys Safely and Easily

To rotate AWS access keys, first create a new access key in the AWS Management Console or CLI, then update your applications to use the new key. After confirming the new key works, delete the old access key to complete the rotation securely.

Syntax

Use the AWS CLI commands to manage access keys:

• aws iam create-access-key --user-name USERNAME: Creates a new access key for the specified user.
• aws iam delete-access-key --user-name USERNAME --access-key-id ACCESSKEYID: Deletes the specified access key.
• aws iam list-access-keys --user-name USERNAME: Lists all access keys for the user.

Replace USERNAME with your IAM user name and ACCESSKEYID with the key ID to delete.

bash

aws iam create-access-key --user-name USERNAME
aws iam list-access-keys --user-name USERNAME
aws iam delete-access-key --user-name USERNAME --access-key-id ACCESSKEYID

Example

This example shows how to rotate access keys for an IAM user named alice using AWS CLI:

bash

aws iam create-access-key --user-name alice
# Note the new AccessKeyId and SecretAccessKey from the output

# Update your application or environment to use the new keys

aws iam list-access-keys --user-name alice
# Confirm both old and new keys exist

aws iam delete-access-key --user-name alice --access-key-id OLDACCESSKEYID
# Remove the old key after confirming the new key works

Output

{
    "AccessKey": {
        "UserName": "alice",
        "AccessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "Status": "Active",
        "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
        "CreateDate": "2024-06-01T12:00:00Z"
    }
}

Common Pitfalls

• Deleting the old key before updating your applications causes service interruptions.
• Not verifying the new key works before deletion can lock you out.
• Leaving unused keys active increases security risks.

Always test the new key in your environment before deleting the old one.

bash

## Wrong order (causes downtime):
aws iam delete-access-key --user-name alice --access-key-id OLDACCESSKEYID
aws iam create-access-key --user-name alice

## Correct order:
aws iam create-access-key --user-name alice
# Update apps
aws iam delete-access-key --user-name alice --access-key-id OLDACCESSKEYID

Quick Reference

Step	Command / Action	Description
1	aws iam create-access-key --user-name USERNAME	Create a new access key for the user
2	Update your applications	Replace old keys with the new key in your apps or environment variables
3	aws iam list-access-keys --user-name USERNAME	Verify both keys exist and new key works
4	aws iam delete-access-key --user-name USERNAME --access-key-id OLDACCESSKEYID	Delete the old access key to complete rotation

Key Takeaways

Always create a new access key before deleting the old one to avoid downtime.

Update all applications and services to use the new access key before removing the old key.

Verify the new access key works by testing access before deleting the old key.

Remove unused access keys promptly to maintain AWS account security.

Use AWS CLI or Management Console to manage access keys safely and efficiently.