Rotate AWS IAM Access Keys by script

Update (2026): This article documents a legacy approach and is preserved for historical and educational purposes. AWS now recommends temporary credentials through IAM Identity Center for human access and local development, and IAM roles for workloads, instead of long-term IAM user access keys whenever possible.

The 12-hour expiration described below applied to temporary credentials or an organization-specific setup; IAM user access keys do not expire automatically. The original script also deletes the oldest key before validating the replacement and overwrites the default profile in .aws/credentials. Do not use it unchanged in a production environment. A safer rotation flow is: create the new key, configure and test it, deactivate the old key, verify that it is no longer used, and only then delete it.

Context

Provided IAM access keys were set to expire in 12 hours. Developing locally constantly resulted in Token expired exceptions.

Solution

Create an IAM user access key on demand through a script, following AWS recommendations to rotate access keys periodically.

Problem

Creating these access keys and adding them to the .aws/credentials file is a very manual process.

Solution

Script the whole process through the AWS CLI.

Required

• An IAM user name.
• A valid access key for the one-time setup.

Requirements

Given one valid IAM access key for the IAM user, create another access key and configure it under the default profile in .aws/credentials.

Given two valid IAM access keys for the IAM user, delete the oldest one and then create a new one.

Script

# Assuming AWS CLI is installed and you have sufficient permissions
param (
    [Parameter(Mandatory=$true)]
    [string]$IAMUserName
)

# Fetch the access keys for the user
$keys = aws iam list-access-keys --user-name $IAMUserName | ConvertFrom-Json

# If 2 keys exist, delete the oldest one
if ($keys.AccessKeyMetadata.Count -eq 2) {
    # Sorting by CreateDate to find the oldest key
    $oldestKey = $keys.AccessKeyMetadata | Sort-Object CreateDate | Select-Object -First 1

    # Delete the oldest key
    aws iam delete-access-key --user-name $IAMUserName --access-key-id $oldestKey.AccessKeyId
}

# Create a new access key
$newKey = aws iam create-access-key --user-name $IAMUserName | ConvertFrom-Json

# Write to the .aws/credentials file
$credentialsPath = "$env:USERPROFILE\.aws\credentials"
$credentialsContent = @"
[default]
aws_access_key_id = $($newKey.AccessKey.AccessKeyId)
aws_secret_access_key = $($newKey.AccessKey.SecretAccessKey)
"@

# Overwrite the credentials file with the new keys
# You might want to append or edit it if you use multiple profiles
Set-Content -Path $credentialsPath -Value $credentialsContent

Write-Output "Updated .aws/credentials with new access keys."

Usage

.\RotateKeys.ps1 -IAMUserName "YourIAMUserName"

Preconditions

• AWS CLI installed.
• An AWS IAM user created.
• Sufficient IAM permissions to list, create, deactivate, and delete access keys, according to the rotation process you implement.

References

• AWS IAM security best practices
• Update access keys
• AWS CLI IAM command reference
• Original PowerShell Gist