Rotate AWS IAM Access Keys by script

Update (2026): This article documents a legacy approach and is preserved for historical and educational purposes. AWS now recommends temporary credentials through IAM Identity Center for human access and local development, and IAM roles for workloads, instead of long-term IAM user access keys whenever possible. The 12-hour expiration described below applied to temporary credentials or an organization-specific setup; IAM user access keys do not expire automatically. The original script also deletes the oldest key before validating the replacement and overwrites the default profile in .aws/credentials. Do not use it unchanged in a production environment. A safer rotation flow is: create the new key, configure and test it, deactivate the old key, verify that it is no longer used, and only then delete it. Context Provided IAM access keys were set to expire in 12 hours. Developing locally constantly resulted in Token expired exceptions. Solution Create an IAM user access key on demand through a script, following AWS recommendations to rotate access keys periodically. Problem Creating these access keys and adding them to the .aws/credentials file is a very manual process. Solution Script the whole process through the AWS CLI. Required An IAM user name. A valid access key for the one-time setup. Requirements Given one valid IAM access key for the IAM user, create another access key and configure it under the default profile in .aws/credentials. Given two valid IAM access keys for the IAM user, delete the oldest one and then create a new one. Script # Assuming AWS CLI is installed and you have sufficient permissions param ( [Parameter(Mandatory=$true)] [string]$IAMUserName ) # Fetch the access keys for the user $keys = aws iam list-access-keys --user-name $IAMUserName | ConvertFrom-Json # If 2 keys exist, delete the oldest one if ($keys.AccessKeyMetadata.Count -eq 2) { # Sorting by CreateDate to find the oldest key $oldestKey = $keys.AccessKeyMetadata | Sort-Object CreateDate | Select-Object -First 1 # Delete the oldest key aws iam delete-access-key --user-name $IAMUserName --access-key-id $oldestKey.AccessKeyId } # Create a new access key $newKey = aws iam create-access-key --user-name $IAMUserName | ConvertFrom-Json # Write to the .aws/credentials file $credentialsPath = "$env:USERPROFILE\.aws\credentials" $credentialsContent = @" [default] aws_access_key_id = $($newKey.AccessKey.AccessKeyId) aws_secret_access_key = $($newKey.AccessKey.SecretAccessKey) "@ # Overwrite the credentials file with the new keys # You might want to append or edit it if you use multiple profiles Set-Content -Path $credentialsPath -Value $credentialsContent Write-Output "Updated .aws/credentials with new access keys." Usage .\RotateKeys.ps1 -IAMUserName "YourIAMUserName" Preconditions AWS CLI installed. An AWS IAM user created. Sufficient IAM permissions to list, create, deactivate, and delete access keys, according to the rotation process you implement. References AWS IAM security best practices Update access keys AWS CLI IAM command reference Original PowerShell Gist