Managing Access Keys for IAM Users

Access keys are long-term credentials for an IAM user or the AWS account root user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK). For more information, see

Signing AWS API Requests in the Amazon Web Services General Reference.

Access keys consist of two parts: an access key ID (for example, AKIAIOSFODNN7EXAMPLE) and a secret access key (for example, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

). Like a user name and password, you must use both the access key ID and secret access key together to authenticate your requests. Manage your access keys as securely as you do your user name and password.

Important

Do not provide your access keys to a third party, even to help find your canonical user ID. By doing this, you might give someone permanent access to your account.

As a best practice, use temporary security credentials (IAM roles) instead of access keys, and disable any AWS account root user access keys. For more information, see Best Practices for Managing AWS Access Keys in the Amazon Web Services General Reference.

If you still need to use long-term access keys, you can create, modify, view, or rotate your access keys (access key IDs and secret access keys). You can have a maximum of two access keys. This allows you to rotate the active keys according to best practices.

When you create an access key pair, save the access key ID and secret access key in a secure location. The secret access key is available only at the time you create it. If you lose your secret access key, you must delete the access key and create a new one. For more details, see Resetting Your Lost or Forgotten Passwords or Access Keys.

Permissions Required

To create access keys for your IAM user, you must have the permissions from the following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ViewAddAccessKeysForUser",
            "Effect": "Allow",
            "Action": [
                "iam:GetUser",
                "iam:CreateAccessKey",
                "iam:ListAccessKeys"
            ],
            "Resource": "arn:aws:iam::*:user/${aws:username}"
        },
        {
            "Sid": "ListUsersInConsole",
            "Effect": "Allow",
            "Action": "iam:ListUsers",
            "Resource": "*"
        }
    ]
}

To rotate access keys for your IAM user, you must have the permissions from the following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ManageAccessKeysForUser",
            "Effect": "Allow",
            "Action": [
                "iam:DeleteAccessKey",
                "iam:GetAccessKeyLastUsed",
                "iam:UpdateAccessKey",
                "iam:GetUser",
                "iam:CreateAccessKey",
                "iam:ListAccessKeys"
            ],
            "Resource": "arn:aws:iam::*:user/${aws:username}"
        },
        {
            "Sid": "ListUsersInConsole",
            "Effect": "Allow",
            "Action": "iam:ListUsers",
            "Resource": "*"
        }
    ]
}

Managing Access Keys (Console)

You can use the AWS Management Console to manage an IAM user's access keys.

To create, modify, or delete an IAM user's access keys (console)

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

2. In the navigation pane, choose Users.

3. Choose the name of the user whose access keys you want to manage, and then choose the Security credentials tab.

4. In the Access keys section, do any of the following:

   • To create an access key, choose Create access key. Then choose Download .csv file to save the access key ID and secret access key to a CSV file on your computer. Store the file in a secure location. You will not have access to the secret access key again after this dialog box closes. After you have downloaded the CSV file, choose Close. When you create an access key, the key pair is active by default, and you can use the pair right away.

   • To disable an active access key, choose Make inactive.

   • To reenable an inactive access key, choose Make active.

   • To delete an access key, choose its X button at the far right of the row. Then choose Delete to confirm. When you delete an access key, it's gone forever and cannot be retrieved. However, you can always create new keys.

To list the access keys for an IAM user (console)

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

2. In the navigation pane, choose Users.

3. Choose the name of the intended user, and then choose the Security credentials tab. The user's access keys and the status of each key is displayed.

   Note

   Only the user's access key ID is visible. The secret access key can only be retrieved when the key is created.

To list the access key IDs for multiple IAM users (console)

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

2. In the navigation pane, choose Users.

3. If necessary, add the Access key ID column to the users table by completing the following steps:

   1. Above the table on the far right, choose the settings icon ( ).

   2. In Manage columns, select Access key ID.

   3. Choose Close to return to the list of users.

4. The Access key ID column shows each access key ID, followed by its state; for example, 23478207027842073230762374023 (Active) or 22093740239670237024843420327 (Inactive).

   You can use this information to view and copy the access keys for users with one or two access keys. The column displays None for users with no access key.

   Note

   Only the user's access key ID and status is visible. The secret access key can only be retrieved when the key is created.

To find which IAM user owns a specific access key (console)

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

2. In the navigation pane, choose Users.

3. In the search box, type or paste the access key ID of the user you want to find.

4. If necessary, add the Access key ID column to the users table by completing the following steps:

   1. Above the table on the far right, choose the settings icon ( ).

   2. In Manage columns, select Access key ID.

   3. Choose Close to return to the list of users and confirm that the filtered user owns the specified access key.

Managing Access Keys (AWS CLI)

To manage an IAM user's access keys from the AWS CLI, run the following commands.

Managing Access Keys (AWS API)

To manage an IAM user's access keys from the AWS API, call the following operations.

• To disable or reenable an access key: UpdateAccessKey

• To list a user's access keys: ListAccessKeys

• To determine when an access key was most recently used: GetAccessKeyLastUsed

Rotating Access Keys

As a security best practice, we recommend that you regularly rotate (change) IAM user access keys. If your administrator granted you the necessary permissions, you can rotate your own access keys.

Administrators, for details about granting your users permissions to rotate their own access keys, see Allow Users to Manage Their Own Passwords, Access Keys, and SSH Keys. You can also apply a password policy to your account to require that all of your IAM users periodically rotate their passwords. You can choose how often they must do so. For more information, see Setting an Account Password Policy for IAM Users.

Important

As a best practice, do not use your AWS account root user. If you use the AWS account root user credentials, we recommend that you also regularly rotate them. The account password policy does not apply to the root user credentials. IAM users cannot manage credentials for the AWS account root user, so you must use the root user credentials (not a user's) to change the root user credentials. Note that we recommend against using the root user for everyday work in AWS.

Rotating Access Keys (Console)

You can rotate access keys from the AWS Management Console.

To rotate access keys without interrupting your applications (console)

1. While the first access key is still active, create a second access key.

   1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

   2. In the navigation pane, choose Users.

   3. Choose the name of the intended user, and then choose the Security credentials tab.

   4. Choose Create access key and then choose Download .csv file to save the access key ID and secret access key to a .csv file on your computer. Store the file in a secure location. You will not have access to the secret access key again after this closes. After you have downloaded the .csv file, choose Close.

      The new access key is active by default. At this point, the user has two active access keys.

2. Update all applications and tools to use the new access key.

3. Determine whether the first access key is still in use by reviewing the Last used column for the oldest access key. One approach is to wait several days and then check the old access key for any use before proceeding.

4. Even if the Last used column value indicates that the old key has never been used, we recommend that you do not immediately delete the first access key. Instead, choose Make inactive to deactivate the first access key.

5. Use only the new access key to confirm that your applications are working. Any applications and tools that still use the original access key will stop working at this point because they no longer have access to AWS resources. If you find such an application or tool, you can choose Make active to reenable the first access key. Then return to Step 3 and update this application to use the new key.

6. After you wait some period of time to ensure that all applications and tools have been updated, you can delete the first access key:

   1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

   2. In the navigation pane, choose Users.

   3. Choose the name of the intended user, and then choose the Security credentials tab.

   4. Locate the access key to delete and choose its X button at the far right of the row. Then choose Delete to confirm.

To determine when access keys need rotating (console)

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

2. In the navigation pane, choose Users.

3. If necessary, add the Access key age column to the users table by completing the following steps:

   1. Above the table on the far right, choose the settings icon ( ).

   2. In Manage columns, select Access key age.

   3. Choose Close to return to the list of users.

4. The Access key age column shows the number of days since the oldest active access key was created. You can use this information to find users with access keys that need rotating. The column displays None for users with no access key.

Rotating Access Keys (AWS CLI)

You can rotate access keys from the AWS Command Line Interface.

To rotate access keys without interrupting your applications (AWS CLI)

1. While the first access key is still active, create a second access key, which is active by default. Run the following command:

   • At this point, the user has two active access keys.

2. Update all applications and tools to use the new access key.

3. Determine whether the first access key is still in use by using this command:

   One approach is to wait several days and then check the old access key for any use before proceeding.

4. Even if step Step 3 indicates no use of the old key, we recommend that you do not immediately delete the first access key. Instead, change the state of the first access key to Inactive using this command:

5. Use only the new access key to confirm that your applications are working. Any applications and tools that still use the original access key will stop working at this point because they no longer have access to AWS resources. If you find such an application or tool, you can switch its state back to Active to reenable the first access key. Then return to step Step 2 and update this application to use the new key.

6. After you wait some period of time to ensure that all applications and tools have been updated, you can delete the first access key with this command:

For more information, see the following:

• How to Rotate Access Keys for IAM Users. This entry on the AWS Security Blog provides more information on key rotation.

• IAM Best Practices. This page provides general recommendations for helping to secure your AWS resources.

Rotating Access Keys (AWS API)

You can rotate access keys using the AWS API.

To rotate access keys without interrupting your applications (AWS API)

1. While the first access key is still active, create a second access key, which is active by default. Call the following operation:

   • At this point, the user has two active access keys.

2. Update all applications and tools to use the new access key.

3. Determine whether the first access key is still in use by calling this operation:

   One approach is to wait several days and then check the old access key for any use before proceeding.

4. Even if step Step 3 indicates no use of the old key, we recommend that you do not immediately delete the first access key. Instead, change the state of the first access key to Inactive calling this operation:

5. Use only the new access key to confirm that your applications are working. Any applications and tools that still use the original access key will stop working at this point because they no longer have access to AWS resources. If you find such an application or tool, you can switch its state back to Active to reenable the first access key. Then return to step Step 2 and update this application to use the new key.

6. After you wait some period of time to ensure that all applications and tools have been updated, you can delete the first access key calling this operation:

For more information, see the following:

• How to Rotate Access Keys for IAM Users. This entry on the AWS Security Blog provides more information on key rotation.

• IAM Best Practices. This page provides general recommendations for helping to secure your AWS resources.