Allowing users to rotate their own IAM access key in a different environment using their AWS SSO account

Thank you for the reply, Gary. I would like to understand your comment of not needing to have separate access for console or cli. My organization uses console access (via SSO) for read only access to the environments, and uses separate CLI access (via IAM programmatic) to provide admin access to the users that need it. We also use the 2nd method because the developers need an access / secret key when interacting with an AWS resource, like code commit. If I am understanding your comment correctly, could we use those program keys in replace of an access key / secret key?

Thank you for your time.

Exactly! IAM Identity Center (SSO) does not only provide access to the console, but can also be used to generate temporary credentials for use in the CLI (for example). In both cases, the credentials used to authenticate in an account are temporary, meaning that you don't need static / long-term access keys anymore.

You can find more information about how to use IAM Identity center in the documentation, at Configure the AWS CLI to use AWS IAM Identity Center. To quickly test the functionality, you can also generate temporary credentials from the browser, if you choose "Command line or programmatic access" instead of "Access Management console" on the accounts list, you'll be presented with temporary credentials which you can use in the command line.

Also note that using this type of access and static IAM access keys don't influence each other, meaning that you can test the new approach without impact, leaving the existing solution in-place until you feel comfortable with the new solution.