Why have two keys for the Product Advertising API

Thank you for raising this important question about API key management. Let me explain the purpose of having two API keys in a more comprehensible manner: The two-key system is designed for seamless key rotation and continuous service operation. The proper procedure should be:

Keep both existing keys operational

Generate new key(s) when rotation is needed

Implement the new key(s) in your application

Verify functionality

Only after confirmation, deactivate the old key(s)

The issue you encountered occurred because the old key was deleted before properly establishing the new one. Both keys becoming invalid is actually a security measure, not a design flaw.

Regarding the 90-day rotation recommendation: This best practice is entirely feasible when following the correct rotation procedure outlined above. The 72-hour service interruption you experienced was due to the key deletion sequence, not an inherent requirement of key rotation.

To address your specific concern: The two keys are indeed linked for security purposes, but this doesn't negate their utility. Their primary value lies in enabling secure key rotation and providing backup access if needed.

For future reference, I would strongly recommend:

Maintaining both keys active during rotation

Testing new keys thoroughly before deactivating old ones

Planning key rotations in advance to prevent service disruptions

I trust this clarifies the purpose and proper utilization of the dual-key system.

There seems to be some confusion in the information you've received. Typically, AWS access keys do not behave in the manner described. Let me clarify a few points:

1. AWS IAM users can have up to two active access keys at a time. These keys are independent of each other and do not "act as one."

2. Creating or deleting one access key should not invalidate the other key. They are separate credentials.

3. There is no standard 72-hour activation period for newly created access keys. They are usually active immediately upon creation.

4. Having two keys is indeed useful for rotating keys without service interruption. You can create a new key, update your applications to use the new key, and then delete the old key.

5. The recommendation to change keys every 90 days is a security best practice, not a technical requirement. Changing keys doesn't automatically cause downtime if done correctly.

The behavior you've described is not typical for AWS IAM access keys. It's possible there was a misunderstanding in the support conversation, or there might be some specific circumstances related to the Product Advertising API that differ from standard AWS practices.

For the Product Advertising API specifically, you might want to double-check the documentation or reach out to support again for clarification. The behavior you've described doesn't align with how AWS access keys typically function.

Regarding the throttling error, this is usually related to exceeding the allowed request rate for the API, rather than key expiration or invalidation. Each API key typically has its own quota, so using a different valid key shouldn't inherit throttling from another key.

If you're still experiencing issues, it might be worth discussing the specific throttling limits and your usage patterns with the Product Advertising API support team to ensure you're within the allowed limits.
Sources
AccessKeyMetadata - AWS Identity and Access Management
[bug report] [IAM] you can create more than 2 access keys per user | AWS re:Post

Hi, were you able to resolve this? I am having the same issue.