IAM.3: Long-lived access keys have not been rotated

What does AWS Security Hub IAM.3 check?

IAM.3 fails when an active IAM access key has not been rotated within 90 days. The control reads each user's key creation date from the credential report and flags any long-lived key past that age.

Why does IAM.3 matter?

A leaked access key is weaponised in minutes: security researchers who plant dummy keys in public GitHub repositories have measured the median time from a key going public to the first malicious API call at under four minutes (some honeypot studies see it inside a minute). The longer a key lives, the more places it has been copied into and the wider its blast radius. Regular rotation caps the window any single exposed secret stays useful.

How do I fix IAM.3?

1. Pull the credential report and identify keys older than 90 days.
2. Mint a second key, roll it out to every consumer, then deactivate (don't yet delete) the old one.
3. Once nothing breaks, delete the deactivated key.
4. Where you can, retire long-lived keys entirely in favour of instance roles, IAM Roles Anywhere, or OIDC federation for CI/CD.

# Stop the irreversible clock first: cancel any scheduled deletion, then re-enable.
for k in $(aws kms list-keys --query 'Keys[].KeyId' --output text); do
  state=$(aws kms describe-key --key-id "$k" \
    --query 'KeyMetadata.KeyState' --output text)
  if [ "$state" = "PendingDeletion" ]; then
    aws kms cancel-key-deletion --key-id "$k"
    aws kms enable-key --key-id "$k"   # cancel leaves it Disabled
    echo "$k: deletion cancelled and re-enabled"
  fi
done

# Turn rotation on for eligible customer-managed symmetric keys.
for k in $(aws kms list-keys --query 'Keys[].KeyId' --output text); do
  read -r mgr spec <<<"$(aws kms describe-key --key-id "$k" \
    --query 'KeyMetadata.[KeyManager,KeySpec]' --output text)"
  if [ "$mgr" = "CUSTOMER" ] && [ "$spec" = "SYMMETRIC_DEFAULT" ]; then
    aws kms enable-key-rotation --key-id "$k"
  fi
done