IAM user access key has not been rotated in over 180 days

Severity: High
Service: IAM
Check ID: USER_ACCESS_KEY_STALE

What this check finds

An access key that has not been rotated for more than 180 days represents a significantly elevated risk. Long-lived credentials are far more likely to have been inadvertently exposed in logs, source code, or configuration files. At 180 days the window of undetected exposure becomes operationally unacceptable.

Passing looks like: IAM access keys rotated within 180 days.

How to fix it

Rotate the key immediately. Create a new key, update all services using the old key, then delete it.

AWS CLI

aws iam create-access-key --user-name USERNAME

Update dependent services, then delete the old key:

aws iam delete-access-key --user-name USERNAME --access-key-id OLD_KEY_ID

Consider switching to IAM roles or short-lived credentials via AWS STS instead of long-lived access keys.

Names in capitals are placeholders for your own resource. Review a command before you run it.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to IAM user access key has not been rotated in over 180 days
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	1.13 Ensure access keys are rotated every 90 days or less
PCI-DSS v4.0.1	8.6 Use of application and system accounts and associated authentication factors is managed
SOC 2 — Trust Services Criteria	CC6.2 Role-Based Access Control
NIST SP 800-53 Rev5 (Moderate)	AC-2 Account Management IA-5 Authenticator Management
NIST Cybersecurity Framework 2.0	PR.AA-01 Identities and credentials are managed
ISO/IEC 27001:2022 Annex A	A.5.16 Identity management A.5.17 Authentication information A.5.18 Access rights A.6.5 Responsibilities after termination or change of employment

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM checks

All IAM checks