Extending Access keys duration, and Custom Config rules


Hi. Rally hope someone can shed some light on this questions:

I understand as a best practice, access key age should be 90 days or less.

a - Is this 90 day limit set in stone? Can we have users who can have access keys going over 90 days and still use their keys? b - If maximum age is 90 days, what happens after 90 days? Do they keys stay on the console, and we have to delete them manually? Or do they get deleted automatically by AWS?

c - I was reading this article: https://aws.amazon.com/blogs/mt/announcing-aws-config-custom-rules-using-guard-custom-policy/

Can I use the above approach to create custom Config rules with Guard policy that checks the age of the access keys and only throws non-compliant error if the access key is over 365 days?

If I cannot use this approach, is there any other way?


2개 답변
수락된 답변

a) The 90 day limit for access keys is a best practice recommendation rather than a strict limit. Access keys can technically work for longer than 90 days. However, keeping keys rotated frequently helps reduce security risks in case a key gets compromised.

b) After 90 days, access keys will continue to work. They do not get automatically deleted. It is recommended to periodically review keys and delete any that are no longer needed.

c) Yes, it is possible to create a custom Config rule using GuardDuty policies to check the age of access keys and trigger a non-compliant finding if they exceed 365 days. The blog post you referenced provides guidance on building custom Config rules with GuardDuty policies.

Some additional points:

Using IAM roles with temporary security credentials helps reduce risks compared to long-term access keys. Where possible, applications should assume roles rather than use static keys.

Be sure to regularly review all access keys for all users and delete any that are no longer needed.

profile picture
답변함 3달 전
profile picture
검토됨 2달 전
profile picture
검토됨 3달 전

I found out that the JSON property that gives out access key age is called.


This property can be used to check when the key was created

답변함 3달 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠