cis-aws-foundations-2-12

name	cis-aws-foundations-2.12
description	Ensure access keys are rotated every 90 days or less
category	cis-iam
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","iam","access-keys","key-rotation","credentials"]
cis_id	2.12
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-2.11","cis-aws-foundations-2.13"]
prerequisites	[]
severity_boost	{}

Ensure access keys are rotated every 90 days or less

Description

Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests to AWS. IAM users require access keys to make programmatic calls via the AWS CLI, SDKs, or APIs. It is recommended that all access keys be rotated regularly and at least every 90 days.

Rationale

Rotating access keys reduces the window of opportunity for a compromised or exposed key to be used. Regular rotation also limits the risk associated with lost, stolen, or improperly stored credentials.

Impact

Long-lived access keys increase the risk of unauthorized access if compromised, as they may remain valid indefinitely without detection.

Audit Procedure

Using AWS Console

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam
2. Click on Users
3. For each user, go to Security Credentials
4. Review each key under Access Keys
5. For each key with Status = Active, ensure the Created date is within 90 days

Using AWS CLI

1. Run the following commands:

aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d

2. Review the following fields:

• access_key_1_last_rotated
• access_key_2_last_rotated

3. Ensure all active keys have been rotated within 90 days

Expected Result

All active access keys should have a last_rotated date within the last 90 days. No access key should be older than 90 days.

Remediation

Using AWS Console

Perform the following to rotate access keys:

1. Sign in to the AWS Management Console and open the IAM console (https://console.aws.amazon.com/iam)
2. Click on Users
3. Select the user
4. Navigate to Security credentials

Rotate Access Keys:

5. Click Create access key