Lion Cipher Lab

Rotate AWS IAM access keys with zero downtime

• Cloud Security
• Intermediate
• ~45 min
• Free · no account required

Why it matters

Long-lived AWS IAM access keys are one of the most common cloud-credential risks in existence. An access key is a pair — an Access Key ID (like AKIA...) and a Secret Access Key — that lets code, scripts and third-party tools call AWS without a human at a keyboard. That convenience is exactly the danger: unlike a console password, an access key never expires on its own, so it sits in git history, CI logs, laptops, Docker images, wiki pages and Slack threads for years, and the day one of those places leaks, an attacker has a working credential with whatever permissions that user holds. The…

What you'll learn

• explaining what an AWS IAM access key is (an Access Key ID + Secret Access Key pair for programmatic use), why long-lived keys are one of the most common cloud-credential risks, and why a console password expires on its own but an access key never does
• standing up LocalStack (a local AWS emulator) in Docker and pointing the AWS CLI at it with --endpoint-url and dummy credentials, so the entire exercise runs offline against your own machine and costs nothing
• creating a test IAM user and its first access key, then enumerating every user's keys with list-access-keys and computing key AGE from CreateDate to flag stale keys — the CIS 'credential report' idea done by hand
• performing the make-before-break rotation that AWS designed the two-keys-per-user limit to enable: create a second key, deploy it, set the old key Inactive (not deleted), then delete it once verified
• understanding why you set the old key to Inactive as a reversible test before deleting, and how get-access-key-last-used / its LastUsedDate is the real-world check that no consumer was missed
• measuring the rotation as concrete state transitions with list-access-keys (two Active keys -> old key Inactive -> old key gone), which is exactly the part LocalStack community faithfully supports
• knowing the honest LocalStack caveat: get-access-key-last-used and generate-credential-report have limited fidelity in the community emulator, so you MEASURE the state machine and DESCRIBE the last-used verification
• judgment: rotation shrinks the window a leaked key is useful but does not stop the leak — so when the right move is to rotate, and when it is to eliminate long-lived keys entirely with roles, STS, IAM Roles Anywhere, or OIDC federation

Steps in this lab

1. What an access key is, and why long-lived ones are the risk
2. Stand up LocalStack and point the AWS CLI at it (offline, free)
3. Create a test user and its first key — the credential you will rotate
4. The detection half: enumerate keys and flag the stale and unused ones
5. Rotate, step 1: create the SECOND key and deploy it (make-before-break)
6. Rotate, step 2: set the OLD key Inactive, verify, then delete it
7. Do it better — rotate the keys you must keep, eliminate the ones you can

Open the full interactive lab →