---
title: Access keys should be rotated every 90 days or less
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Access keys should be rotated every 90
  days or less
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Access keys should be rotated every 90 days or less
 
## Description{% #description %}

AWS IAM users should have every active access key rotated within the last 90 days. The rule reads the IAM credential report fields `access_key_1_last_rotated` and `access_key_2_last_rotated` for each key whose status is active; inactive keys are not evaluated. Long-lived access keys increase the risk of unauthorized access if compromised, because they can remain valid indefinitely without detection.

## Remediation{% #remediation %}

1. In the [IAM console](https://console.aws.amazon.com/iam), open **Users**, select the user, go to **Security credentials**, and click **Create access key**. Alternatively, run `aws iam create-access-key --user-name <user-name>`. Update all applications and tools to use the new key.
1. Confirm the old key is no longer used with `aws iam get-access-key-last-used --access-key-id <access-key-id>`, deactivate it with `aws iam update-access-key --access-key-id <access-key-id> --status Inactive --user-name <user-name>`, and then delete it with `aws iam delete-access-key --access-key-id <access-key-id> --user-name <user-name>`. See [Update access keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html).

## References{% #references %}

- [Update access keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html)
- [Getting credential reports for your AWS account](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)