How to rotate AWS access keys automatically

Updated October 2026

AWS gives you the exact steps to rotate an IAM access key without downtime. It does not run those steps for you. Someone, or something, still has to execute them, every time.

Here is the manual process straight from AWS's own docs, and what that leaves you to automate yourself.

The manual steps

AWS's own guide to updating access keys lays out a process built around a simple fact: an IAM user can hold up to two access keys at once.

1. Create a second access key while the first one is still active. The user now has two valid keys.
2. Update every application and tool to use the new key.
3. Check whether the first key is still in use, using aws iam get-access-key-last-used. AWS recommends waiting several days before trusting that check.
4. Deactivate the first key, don't delete it yet, using aws iam update-access-key. This is the safety net. If something still needed the old key, you can switch it back to active.
5. Confirm everything works on the new key alone. Anything still depending on the old one breaks visibly now, while it's still easy to reactivate and fix.
6. Delete the first key, with aws iam delete-access-key, once you're confident nothing needs it.

That sequence is correct and genuinely safe. It also has to be run by hand, by someone who remembers to start it and follows through to the delete step days later.

What AWS Secrets Manager does differently, and doesn't

AWS Secrets Manager's own pricing and rotation documentation describes automatic rotation for secrets stored in Secrets Manager, at $0.40 per secret a month plus $0.05 per 10,000 API calls, with rotation included at no extra charge. That rotation runs on a Lambda function you write for the specific secret type. For a database credential, AWS provides template Lambdas. For an IAM access key specifically, the common pattern is still the access-key workflow above, run inside a Lambda on a schedule, rather than something Secrets Manager does for IAM keys out of the box.

So the honest version is: AWS gives you every building block to automate this, but assembling them, writing the Lambda, scheduling it, handling the failure case, is still a setup project, not a checkbox.

Where this still needs a person today

The step most people skip isn't creating the key. It's steps 3 and 4: waiting long enough to be sure nothing still uses the old key, then coming back days later to delete it. Skipping the wait is how a rotation turns into an outage. Skipping the delete is how an account ends up with years-old access keys that were "rotated" once and never touched again.

What Key Robot does for AWS keys

Key Robot runs these steps for you today, on a schedule you pick (weekly by default, daily on Vercel). It uses a small IAM user you make once, allowed to manage the access keys of your app's IAM user only. It makes the second key, puts both the key id and the secret in your app on Netlify, Vercel, Render, Railway or Cloudflare Workers, checks your app still works, and then deletes the old key. If the check fails, it puts both old values back.

It skips the days-long wait in step 3, because it checks your real app right away instead. Your app's IAM user must have only one key when it starts, since AWS allows two.

One honest catch: AWS takes a while to switch a deleted key off. In our live test on October 26, 2026, a change took 47 to 50 seconds, and AWS kept accepting the deleted key for 15 seconds in one run and 4.6 minutes in another. The robot tells you when an old key still answers. Free for one app, no card.

See Key Robot vs AWS Secrets Manager for how the two actually compare on cost and scope, or the full rotate hub for every service.