OpenParable
Skip to content
← Back to skills

Cis AWS Foundations 2.12

DevOps & Security
cis-aws-foundations-2.12

Cis AWS Foundations 2.12 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure access keys are rotated every 90 days or less

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/AWS/CIS_Amazon_Web_Services_Foundations_Benchmark_v7.0.0/cis-aws-foundations-2.12/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-aws-foundations-2-12, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Ensure access keys are rotated every 90 days or less

Description

Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests to AWS. IAM users require access keys to make programmatic calls via the AWS CLI, SDKs, or APIs. It is recommended that all access keys be rotated regularly and at least every 90 days.

Rationale

Rotating access keys reduces the window of opportunity for a compromised or exposed key to be used. Regular rotation also limits the risk associated with lost, stolen, or improperly stored credentials.

Impact

Long-lived access keys increase the risk of unauthorized access if compromised, as they may remain valid indefinitely without detection.

Audit Procedure

Using AWS Console

  1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam
  2. Click on Users
  3. For each user, go to Security Credentials
  4. Review each key under Access Keys
  5. For each key with Status = Active, ensure the Created date is within 90 days

Using AWS CLI

  1. Run the following commands:
aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d
  1. Review the following fields:
  • access_key_1_last_rotated
  • access_key_2_last_rotated
  1. Ensure all active keys have been rotated within 90 days

Expected Result

All active access keys should have a last_rotated date within the last 90 days. No access key should be older than 90 days.

Remediation

Using AWS Console

Perform the following to rotate access keys:

  1. Sign in to the AWS Management Console and open the IAM console (https://console.aws.amazon.com/iam)
  2. Click on Users
  3. Select the user
  4. Navigate to Security credentials

Rotate Access Keys:

  1. Click Create access key
  2. Update all applications and tools to use the new access key
  3. After confirming successful use of the new key:
  • Deactivate the old key
  • Delete the old key when no longer needed

Using AWS CLI

  1. Create a new access key:
aws iam create-access-key --user-name <user-name>

  1. Update all applications and tools to use the new access key

  2. Check usage of the old key:

aws iam get-access-key-last-used --access-key-id <access-key-id>
  1. Deactivate the old key:
aws iam update-access-key --access-key-id <access-key-id> --status Inactive --user-name <user-name>
  1. After confirming no usage, delete the old key:
aws iam delete-access-key --access-key-id <access-key-id> --user-name <user-name>

Default Value

By default, AWS does not enforce access key rotation. Access keys remain valid until manually deactivated or deleted.

References

  1. CCE-78902-4
  2. https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#rotate-credentials
  3. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_finding-unused.html
  4. https://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html
  5. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html

CIS Controls

Controls VersionControlIG 1IG 2IG 3
v85.1 Establish and Maintain an Inventory of Accounts - Establish and maintain an inventory of all accounts managed in the enterprise. The inventory must include both user and administrator accounts. The inventory, at a minimum, should contain the person's name, username, start/stop dates, and department. Validate that all active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently.xxx
v716.1 Maintain an Inventory of Authentication Systems - Maintain an inventory of each of the organization's authentication systems, including those located onsite or at a remote service provider.xx

MITRE ATT&CK Mappings

Techniques / Sub-techniquesTacticsMitigations
T1078.004TA0006M1018

Profile

Level 1 | Automated