Keep no long-lived access keys

How to do it

People get temporary credentials through single sign-on. Pipelines use OIDC federation. Services use the identity of the machine. Where a static key cannot be avoided, such as for an old third-party tool, scope it to one action and rotate it within 90 days. In Google Cloud, enforce the organization policy iam.disableServiceAccountKeyCreation.

Example

import boto3
from datetime import datetime, timedelta, timezone

MAX_KEY_AGE = timedelta(days=90)
iam = boto3.client("iam")
now = datetime.now(timezone.utc)
for page in iam.get_paginator("list_users").paginate():
    for user in page["Users"]:
        for key in iam.list_access_keys(UserName=user["UserName"])["AccessKeyMetadata"]:
            if key["Status"] == "Active":
                too_old = now - key["CreateDate"] > MAX_KEY_AGE
                print(f"{user['UserName']} {key['AccessKeyId']} {'TOO OLD' if too_old else 'active'}")

import { IAMClient, ListAccessKeysCommand, paginateListUsers } from '@aws-sdk/client-iam';

const MAX_KEY_AGE_MS = 90 * 24 * 60 * 60 * 1000;
const iam = new IAMClient({});
for await (const page of paginateListUsers({ client: iam }, {})) {
  for (const user of page.Users) {
    const { AccessKeyMetadata: keys } = await iam.send(new ListAccessKeysCommand({ UserName: user.UserName }));
    for (const key of keys.filter(k => k.Status === 'Active')) {
      const isTooOld = Date.now() - key.CreateDate.getTime() > MAX_KEY_AGE_MS;
      console.log(user.UserName, key.AccessKeyId, isTooOld ? 'TOO OLD' : 'active');
    }
  }
}

How to check

The script below lists no active key, apart from documented exceptions younger than 90 days. Create a test key in a sandbox account, and the alert arrives within 15 minutes.