Access Keys

Access keys let programs authenticate to AWS. Handle them carefully — they are as sensitive as passwords.

An access key is a pair of values — an Access Key ID (public-ish) and a Secret Access Key (private) — that lets the CLI, SDKs and scripts prove who they are.

Golden rules

  • Never commit keys to Git or paste them into code.
  • Rotate keys regularly and delete unused ones.
  • Each user may have at most two active keys, which makes rotation without downtime possible.
  • Prefer roles — on EC2, Lambda or ECS, use an IAM role so you never handle keys at all.

The secret is shown once

When you create a key, the secret is displayed only at creation time. If you lose it, you must delete the key and create a new one.

Example

Example · bash
# Create a new access key for a user (the secret is shown ONLY now)
aws iam create-access-key --user-name alice

# Rotate: deactivate the old key, then delete it once the new one works
aws iam update-access-key --user-name alice \
  --access-key-id AKIAIOSFODNN7EXAMPLE --status Inactive
aws iam delete-access-key --user-name alice \
  --access-key-id AKIAIOSFODNN7EXAMPLE

When to use it

  • A CI/CD pipeline uses an IAM access key stored as an encrypted environment variable to deploy to AWS from GitHub Actions.
  • A security team rotates all IAM access keys older than 90 days automatically using a Lambda function and the IAM API.
  • A developer accidentally commits an access key to a public repository and immediately deactivates it via 'aws iam update-access-key' before deleting it.

More examples

Create an Access Key for a User

Creates a new access key pair for an IAM user; the secret is only visible at creation time and must be stored securely.

Example · bash
aws iam create-access-key \
  --user-name deploy-bot \
  --query 'AccessKey.{KeyId:AccessKeyId,Secret:SecretAccessKey}' \
  --output table
# SAVE the SecretAccessKey — it is shown only once

List and Audit Access Keys

Lists all access keys for a user including their status and age, enabling you to identify stale or unused keys.

Example · bash
aws iam list-access-keys \
  --user-name deploy-bot \
  --query 'AccessKeyMetadata[].{KeyId:AccessKeyId,Status:Status,Created:CreateDate}' \
  --output table

Deactivate Then Delete Old Key

Deactivates a key before deleting it, providing a safe rollback window if any system still depends on the old key.

Example · bash
# First deactivate (safe rollback point)
aws iam update-access-key \
  --user-name deploy-bot \
  --access-key-id AKIAIOSFODNN7EXAMPLE \
  --status Inactive

# After confirming nothing broke, delete it
aws iam delete-access-key \
  --user-name deploy-bot \
  --access-key-id AKIAIOSFODNN7EXAMPLE

Related

aws cli setupaws iam users groups roles

Discussion

  • Be the first to comment on this lesson.