{
  "id": 205780,
  "title": "Rotate AWS IAM Access Keys by script",
  "url": "https://urgent.news/2026/08/06/rotate-aws-iam-access-keys-by-script",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-06T04:50:33.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/gerardo_leon/rotate-aws-iam-access-keys-by-script-4g8g"
  },
  "original_language": "en",
  "account": "Recent updates reveal that Amazon Web Services (AWS) now advocates for temporary credentials, IAM Identity Center, and IAM roles over long-term IAM user access keys for both human access and workloads. This is due to the fact that IAM user access keys do not expire automatically, and manual rotation of these keys can be a cumbersome process.\n\nIn the past, AWS users were required to manually create and configure new access keys using the AWS Command Line Interface (CLI). The new script automates this process, ensuring the security of user accounts and applications that rely on these keys. The script was designed to address a problem where developers constantly faced token expiration exceptions while working locally due to IAM access key expiration.\n\nTo use this script, one must have an AWS IAM user with sufficient permissions to list, create, deactivate, and delete access keys. The IAMUserName variable must be provided when running the script. The script first retrieves the existing access keys for the specified user. If there are two keys present, the script sorts them by CreateDate and deletes the oldest one. Next, it creates a new access key for the user and writes the new access key ID and SecretAccessKey to the .aws/credentials file under the default profile.\n\nAlthough this script provides a safer rotation flow, users are advised to follow AWS's recommended process: create a new key, test and configure it, deactivate the old key, verify it is no longer in use, and finally delete it. The original script also deleted the oldest key before validating the new one, which is no longer recommended. The script provided does not substitute for AWS's recommended practices and should not be used unchanged in a production environment. AWS has since discouraged the use of IAM user access keys and instead encourages temporary credentials or IAM roles.",
  "summary": "Update (2026): This article documents a legacy approach and is preserved for historical and educational purposes. AWS now recommends temporary credentials through IAM Identity Center for human access and local development, and IAM roles for workloads, instead of long-term IAM user access keys whenever possible. The 12-hour expiration described below applied to temporary credentials or an…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}