Providers / AWS

Cloud

AWS domains, keys and logins

What every AWS credential a founder holds does, whether it expires, and what tends to break. Each fact links to AWS's own docs.

Last checked 2026-11-08 · aws.amazon.com

At a glance

How to rotate the AWS IAM access key

1. Check how many access keys the user has. An IAM user can have a maximum of two access keys, so you may need to delete one before you can create another AWS docs
2. While the first access key is still active, create a second one. Console: IAM > Users > the user > Security credentials tab > Access keys > Create access key; on the Access key best practices & alternatives page choose Other, then Next. CLI: aws iam create-access-key. API: CreateAccessKey. The new key is active by default, so the user then has two active keys AWS docs
3. On the Retrieve access keys page, choose Show or Download .csv file and save the secret access key somewhere secure, then choose Done. This is the only chance to save the secret access key AWS docs
4. Update all applications and tools to use the new access key AWS docs
5. Check whether the first access key is still in use: review the Last used information for the oldest key in the console, run aws iam get-access-key-last-used, or call GetAccessKeyLastUsed. One approach, per AWS, is to wait several days and then check the old key for any use before proceeding AWS docs
6. Deactivate the first key rather than deleting it, even if Last used says it was never used. Console: Actions > Deactivate. CLI: aws iam update-access-key to set the state to Inactive. API: UpdateAccessKey AWS docs
7. Use only the new key to confirm your applications work. Anything still using the original key stops working at this point. If you find such an application, reactivate the first key (set the state back to Active), update that application to use the new key, and check again AWS docs
8. After waiting long enough to be sure every application and tool is updated, delete the first key. Console: Access keys section > Actions > Delete, then follow the dialog to first Deactivate and confirm the deletion. CLI: aws iam delete-access-key. API: DeleteAccessKey AWS docs

Can the old and new key work at the same time? Yes. An IAM user can have a maximum of two access keys, and a newly created key is active by default, so both work at once until you deactivate the first. The two-key maximum is stated on the access-keys page, so you may need to delete one key before creating another.

Revoking the old one: Deactivate the old key first (console Actions > Deactivate, aws iam update-access-key, or UpdateAccessKey), confirm nothing breaks, then delete it (console Actions > Delete, aws iam delete-access-key, or DeleteAccessKey). AWS recommends not deleting immediately even if Last used shows no use.

Source: docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html, checked 2026-11-09

Does the AWS IAM access key expire?

No. The AWS IAM access key doesn't expire on its own: it works until you revoke it.

What breaks when the AWS IAM access key expires

AWS's access keys page calls access keys long-term credentials (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html), and the pages read for this entry do not describe a built-in expiry. Rotation is manual. When the old key is deactivated, AWS says any application or tool still using it stops working because it no longer has access to AWS resources; if that happens you can reactivate the key while you update the application. The pages read do not give an error code or message for a deactivated or deleted key. If you lose a secret access key, you cannot retrieve it: delete that key and create a new one.

Other things that often go wrong with AWS:

• Long-lived IAM user access key is leaked or left active after the person who owned it leaves
• Identity Center permission-set session expires mid-task, so long CLI jobs fail
• SES SMTP password stops working because the IAM user was deleted or the region endpoint changed
• Root user email inbox is lost, which blocks account recovery

How to rotate the Amazon SES SMTP credentials

1. To change your SMTP password, delete the existing SMTP user in the IAM console (the SES SMTP settings page has a Manage my existing SMTP credentials link that opens IAM; deleting users is covered under Managing IAM Users) AWS docs
2. Then generate a new set of SMTP credentials: in the SES console choose SMTP settings > Create SMTP Credentials (the IAM console opens), enter a user name or keep the default, and choose Create user AWS docs
3. Choose Show under SMTP password and download the .csv file or copy the credentials into a safe place. You cannot view or save them after you close the dialog box. Then choose Return to SES console AWS docs
4. Repeat for each AWS Region you send from: SMTP credentials are unique to each Region, so you need a set for every Region you use AWS docs

Can the old and new key work at the same time? AWS's docs don't say. The page documents deleting the existing SMTP user and then generating new credentials; it does not say whether the old and new credentials can work at the same time. The page also describes deriving an SMTP password from an existing IAM user's secret access key; in that case the IAM access key entry is the relevant one.

Revoking the old one: Delete the old SMTP user in the IAM console. This is the documented way to change the SMTP password.

Source: docs.aws.amazon.com/ses/latest/dg/smtp-credentials.html, checked 2026-11-09

Does the Amazon SES SMTP credentials expire?

AWS's docs don't say whether the Amazon SES SMTP credentials expires.

What breaks when the Amazon SES SMTP credentials expires

The page read does not describe any expiry for SES SMTP credentials and does not say what error SES returns when credentials are deleted or no longer valid. Unknown.

Each credential

AWS account root user (email and password)

• Not documented

Full access to every service and resource, and the only identity for tasks such as closing the account. MFA is enforced by default for root users, but adding it requires action. Root access keys can be created and deleted and are only needed for tasks that cannot be done otherwise.

AWS docs

IAM user access key pair

• Doesn't expire
• Can be scoped

AWS describes IAM user access keys as long-term credentials that never expire, unlike temporary STS credentials. A user can have a maximum of two access keys, which allows rotation: create the second key, switch applications, deactivate the first, then delete it. The secret key can be retrieved only at creation. The API exposes last-used data through GetAccessKeyLastUsed. Permissions come from IAM policies attached to the user.

AWS docs

IAM Identity Center permission-set session (CLI and console)

• You choose, max 0.5 days
• Can be scoped

Session length is set per permission set. The default for a new permission set is 1 hour (not recorded in days, so left null), the minimum is 1 hour, and the maximum is 12 hours (0.5 days). Changing it reprovisions every account using that permission set. Sessions keep running after a user is disabled or signs out, until they expire.

AWS docs

IAM Identity Center user sign-in session

• You choose, max 90 days
• Full access only

The portal sign-in session can last up to 90 days as configured in Identity Center. The default was not confirmed. Application sessions refresh about every 30 minutes and end when the sign-in session ends.

AWS docs

SES SMTP credentials

• Not documented
• Can be scoped

The SMTP username is the IAM access key ID and the SMTP password is derived from the secret key, so one password works per region. Each region needs its own credentials. They cannot be derived from temporary credentials. Rotating means deleting the SMTP IAM user and creating new credentials. Send permission is granted by a policy allowing ses:SendRawEmail, and AWS recommends attaching it through a group.

AWS docs

Renewals and billing

• Route 53 domain registration. Only add if the account registers domains.

Cost Explorer GetCostAndUsage returns cost and usage by DAILY, MONTHLY or HOURLY granularity, grouped by dimension or tag. AWS pricing page: each request on the primary billing view costs $0.01 (custom billing views $0.01 per source).

What AWS's docs don't say

We couldn't confirm these from official docs, so don't rely on them either way:

• Whether access key creation date is returned by the API
• Default Identity Center user sign-in session duration
• Whether SES SMTP credentials expire independently of the IAM key
• Root user password expiry
• Route 53 domain renewal behavior and billing model
• IAM user access keys never expiring: not stated on the pages read for rotation, which call them long-term credentials
• Error returned when a deactivated or deleted IAM key is used
• Whether a new SES SMTP user can be created before the old one is deleted
• Error SES SMTP returns for deleted or invalid credentials
• Whether rotating an IAM key converted into SMTP credentials changes the SMTP password

Rotating or replacing a AWS key

The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:

Sources

• docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
• docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html
• docs.aws.amazon.com/singlesignon/latest/userguide/howtosessionduration.html
• docs.aws.amazon.com/singlesignon/latest/userguide/authconcept.html
• docs.aws.amazon.com/ses/latest/dg/smtp-credentials.html
• docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html
• docs.aws.amazon.com/IAM/latest/UserGuide/security-creds-programmatic-access.html
• docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetCostAndUsage.html
• docs.aws.amazon.com/service-authorization/latest/reference/list_ce.html
• aws.amazon.com/aws-cost-management/aws-cost-explorer/pricing/

Related providers

Keep track of every AWS key

StackHangar stores your AWS keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.