World map

 

BM

World A2: Keys & Guards

Access keys: avoid them, rotate them

You will learn: why access keys are risky, what to use instead, and how to rotate one safely.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

A laptop is stolen from Kancil’s car. On it: an old AWS key in a file. The key never expires. What now?

Watch

bash
aws iam list-access-keys --user-name Bob
{
"AccessKeyMetadata": [
{
"UserName": "Bob",
"Status": "Active",
"CreateDate": "2013-06-04T18:17:34Z",
"AccessKeyId": "AKIAIOSFODNN7EXAMPLE"
},
{
"UserName": "Bob",
"Status": "Inactive",
"CreateDate": "2013-06-06T20:42:26Z",
"AccessKeyId": "AKIAI44QH8DHBEXAMPLE"
}
]
}

An access key: A long-lasting key pair (an ID and a secret) for an IAM user. Avoid it; prefer roles. is an ID plus a secret. It lasts until you delete it. A user can have two at most.

Try it

Swapping an old key for a new one is called rotating. Put the safe steps in order.

First step at the top. Put these in order. Use the arrows, or drag.

  • Move every app to the new key
  • Create a second, new key
  • Switch the old key to Inactive
  • Delete the old key
  • Wait and check that nothing broke

Try it

Switch Bob’s old key off. Build the command.

Tap the pieces in the right order.

…

Predict

After you switch the old key off, an old script breaks. Can you fix it fast?

Check

Better than a long-lived key, or still risky? Swipe each one.

Swipe right for good, left for needs work. Or use the buttons.

1 / 4

On my laptop: aws login or aws sso login.

You did it!

You can now avoid access keys, and rotate one safely when you must.

Go deeper (optional)

AWS shows the secret part only once, when the key is made. Lost it? Delete the key and make a new one.

aws iam get-access-key-last-used tells you when a key last worked. Unused for months? Delete it. Deleting is forever, so switch it off first.