High access key rotation period

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: cloudformation-aws-access-key-not-rotated-within-90-days

Provider: AWS

Platform: CloudFormation

Severity: Medium

Category: Secret Management

Learn More

Description

IAM access keys must be rotated regularly to reduce the risk from long-lived credentials and limit the exposure window if a key is compromised. Ensure an AWS::Config::ConfigRule resource exists with Source.SourceIdentifier set to ACCESS_KEYS_ROTATED and that its InputParameters contain a maxAccessKeyAge value less than or equal to 90 (days). Resources missing this ConfigRule, missing InputParameters, or with maxAccessKeyAge > 90 will be flagged; maxAccessKeyAge is evaluated numerically and is often provided as a string.

Secure configuration example (CloudFormation):

AccessKeyRotationRule:
  Type: AWS::Config::ConfigRule
  Properties:
    ConfigRuleName: enforce-access-key-rotation
    Source:
      Owner: AWS
      SourceIdentifier: ACCESS_KEYS_ROTATED
    InputParameters: '{"maxAccessKeyAge":"90"}'

Compliant Code Examples

Resources:
  ConfigRule:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: access-keys-rotated
      InputParameters:
        maxAccessKeyAge: 90
      Source:
        Owner: AWS
        SourceIdentifier: ACCESS_KEYS_ROTATED
      MaximumExecutionFrequency: TwentyFour_Hours

Non-Compliant Code Examples

Resources:
  ConfigRule:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: access-keys-rotated
      InputParameters:
        maxAccessKeyAge: 100
      Source:
        Owner: AWS
        SourceIdentifier: ACCESS_KEYS_ROTATED
      MaximumExecutionFrequency: TwentyFour_Hours