Credential Rotation
Data ProtectionCredential Rotation means periodically replacing credentials with new values. If a credential was compromised without detection, rotation limits the attacker's window of access.
What to Rotate and How
- IAM access keys: rotate every 90 days (CIS benchmark); use
aws iam create-access-keythen delete the old one - Database passwords: Secrets Manager can rotate RDS passwords automatically on a schedule
- KMS keys: automatic rotation on a configurable schedule (90 days to 7 years, default annual; new key material, old data still decryptable)
- TLS certificates: ACM handles renewal automatically for AWS-issued certificates
Related Terms
A long-term credential pair (access key ID + secret access key) used to authenticate programmatic requests to AWS. Should be replaced with IAM roles wherever possible.
The practice of securely storing, accessing, and rotating sensitive data like API keys, database passwords, and tokens using services like AWS Secrets Manager.
A cryptographic key managed by AWS Key Management Service used to encrypt and decrypt data across AWS services, with centralized key policies and automatic rotation.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.