AWS Access Key Rotation

As part of our GISS – Global Information Security System practices, we'd like to remind all engineers to regularly rotate their AWS access keys.

Keeping your credentials up to date is a simple but critical step in protecting our infrastructure and reducing security risks.

🔐 Here's what we ask:

• Rotate your AWS IAM user access keys at least every 90 days.
• Delete any inactive or unused keys.
• Avoid embedding long-term credentials in code or config files — consider using temporary credentials (e.g., via AWS CLI or AWS SSO) whenever possible.

🛠 Step-by-Step Guide: How to Deactivate, Delete Old Keys, and Create a New One

1. Log in to your AWS account.

   

2. Click your username in the top-right corner and select Security Credentials.

   

3. Under 'Access keys', find the outdated key, click Actions, and choose Deactivate.

   

4. Click Actions again, choose Delete, confirm the Access Key ID, and delete the key.

   

5. Click on the "Create Access Key" button. Generate a new access key pair, select the Command Line Interface (CLI) option, and confirm the changes by checking the box and click the Next and Create access key

   

6. Update your configurations to use the new keys.

   • If you access AWS resources using the AWS CLI, you will need to update the ~/.aws/credentials file.

   • If you use Cyberduck, locate any S3 bookmarks, right-click and "Edit Bookmark". Update the "Access Key ID" and "Secret Access Key" fields with your new keys.

   

   For any other applications, refer to the application documentation.