IAM user access key has not been rotated in over 90 days

Severity: Low
Service: IAM
Check ID: USER_ACCESS_KEY_NOT_ROTATED

What this check finds

Access keys that are not regularly rotated increase the window of exposure if the key is leaked. CIS 1.14 requires rotating all active access keys every 90 days or less. This is distinct from key inactivity — a key that is actively used but was created more than 90 days ago still needs to be rotated.

Passing looks like: IAM access keys rotated within 90 days.

How to fix it

Create a new access key, update all services using the old key, then delete the old key.

AWS CLI

aws iam create-access-key --user-name USERNAME

Once nothing uses the old key, remove it:

aws iam delete-access-key --user-name USERNAME --access-key-id OLD_KEY_ID

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

IAM → Users → select user → Security credentials → Access keys.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to IAM user access key has not been rotated in over 90 days
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	1.13 Ensure access keys are rotated every 90 days or less
PCI-DSS v4.0.1	8.6 Use of application and system accounts and associated authentication factors is managed
SOC 2 — Trust Services Criteria	CC6.2 Role-Based Access Control
NIST SP 800-53 Rev5 (Moderate)	IA-5 Authenticator Management
NIST Cybersecurity Framework 2.0	PR.AA-01 Identities and credentials are managed
ISO/IEC 27001:2022 Annex A	A.5.17 Authentication information

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM checks

All IAM checks