Question

A financial services company must enforce a compliance policy that requires all IAM user access keys to be rotated every 90 days across a single AWS account. The security team wants an automated, auditable mechanism that continuously detects access keys older than 90 days and automatically deactivates them without requiring engineers to write custom polling scripts or maintain long-running compute. Which solution best meets these requirements with the least operational overhead?

Accepted Answer

Create an AWS Config managed rule 'access-keys-rotated' with maxAccessKeyAge set to 90, and attach an SSM Automation remediation action that deactivates non-compliant keys.

Answer

Schedule a Lambda function with EventBridge to run daily, call the IAM API to list all access keys, compare creation dates, and deactivate keys older than 90 days.

Answer

Enable Amazon GuardDuty and create an EventBridge rule that triggers a Lambda function to deactivate keys whenever GuardDuty reports stale credential findings.

Answer

Configure AWS Security Hub with the CIS benchmark standard and rely on its automated remediation to deactivate access keys older than 90 days.