IAM user does not have active access keys older than 90 days

Check ID: iam_rotate_access_key_90_days
Provider: AWS
Service: iam
Severity: MEDIUM
Categories: secrets
Resource type: AwsIamUser

What this check verifies

IAM user access keys are assessed via the credential report. For each active key, the last_rotated timestamp is compared to 90 days; keys exceeding this age are identified. Users without keys or with only recent rotations are noted.

Risk

Long-lived access keys widen the attack window. If a key is leaked in code, logs, or tooling, lack of rotation keeps it valid for abuse, enabling unauthorized API calls, data exfiltration, and tampering. This degrades confidentiality and integrity and can impact availability and cost through destructive or excessive operations.

Recommendation

Apply least privilege and limit static credentials:

Rotate active access keys at or before 90 days
Prefer IAM roles with short-lived tokens
Maintain only one active key during rotation; delete the old one
Monitor last_used and remove dormant keys
Automate alerts and periodic reviews of key age

Remediation

CLI
Terraform
Dashboard steps

aws iam update-access-key —user-name <USER_NAME> —access-key-id <ACCESS_KEY_ID> —status Inactive

resource "aws_iam_access_key" "<example_resource_name>" {
  user   = "<example_resource_name>"
  status = "Inactive" # Critical: disables the access key to ensure no active key is older than 90 days
}

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_rotate_access_key_90_days. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires