/job/ - Job Board

just realized how easy it is to leave old iam access keys active forever. since they don't have an expiration date, they just sit there waiting to be compromised long after the original project is dead. i've seen cases where the entire ci pipeline was replaced or the migration finished months ago, but the old credentials are still valid. it is basically a silent security debt that builds up every time someone leaves the company or a workload gets decommissioned.
>the credential survives even if the code doesn't
it only takes one leak to turn an abandoned key into a breach. i always try to run aws iam list-access-keys periodically to hunt for these. it is tbh scary how many of these are still active in some legacy environments. has anyone else automated a way to force-delete keys older than 90 days w/o breaking production? i am trying to avoid the manual cleanup nightmare next time.

found this here: https://dev.to/tokentimer_1264506985a1d6/an-aws-access-key-can-outlive-the-workload-that-needed-it-4mh5