Cis AWS Foundations 2.12

Ensure access keys are rotated every 90 days or less

Description

Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests to AWS. IAM users require access keys to make programmatic calls via the AWS CLI, SDKs, or APIs. It is recommended that all access keys be rotated regularly and at least every 90 days.

Rationale

Rotating access keys reduces the window of opportunity for a compromised or exposed key to be used. Regular rotation also limits the risk associated with lost, stolen, or improperly stored credentials.

Impact

Long-lived access keys increase the risk of unauthorized access if compromised, as they may remain valid indefinitely without detection.

Audit Procedure

Using AWS Console

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam
2. Click on Users
3. For each user, go to Security Credentials
4. Review each key under Access Keys
5. For each key with Status = Active, ensure the Created date is within 90 days

Using AWS CLI

1. Run the following commands:

aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d

2. Review the following fields:

• access_key_1_last_rotated
• access_key_2_last_rotated

3. Ensure all active keys have been rotated within 90 days

Expected Result

All active access keys should have a last_rotated date within the last 90 days. No access key should be older than 90 days.

Remediation

Using AWS Console

Perform the following to rotate access keys:

1. Sign in to the AWS Management Console and open the IAM console (https://console.aws.amazon.com/iam)
2. Click on Users
3. Select the user
4. Navigate to Security credentials

Rotate Access Keys:

5. Click Create access key
6. Update all applications and tools to use the new access key
7. After confirming successful use of the new key:

• Deactivate the old key
• Delete the old key when no longer needed

Using AWS CLI

1. Create a new access key:

aws iam create-access-key --user-name <user-name>

2. Update all applications and tools to use the new access key

3. Check usage of the old key:

aws iam get-access-key-last-used --access-key-id <access-key-id>

4. Deactivate the old key:

aws iam update-access-key --access-key-id <access-key-id> --status Inactive --user-name <user-name>

5. After confirming no usage, delete the old key:

aws iam delete-access-key --access-key-id <access-key-id> --user-name <user-name>

Default Value

By default, AWS does not enforce access key rotation. Access keys remain valid until manually deactivated or deleted.

References

1. CCE-78902-4
2. https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#rotate-credentials
3. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_finding-unused.html
4. https://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html
5. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 | Automated