AWS Config compliance result proving long-lived IAM access keys (including those used by service/non-user identities) are rotated within the maximum age
The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.
partial — needs judgementconfig-rulecontinuousAWS ConfigIAM
Fetch
$ aws configservice get-compliance-details-by-config-rule --config-rule-name access-keys-rotated --compliance-types NON_COMPLIANT$ aws configservice describe-configuration-recorder-status$ aws configservice describe-config-rule-evaluation-status --config-rule-names access-keys-rotatedExpected output
EvaluationResults array; empty NON_COMPLIANT set means every active access key is within maxAccessKeyAge. Managed rule identifier: ACCESS_KEYS_ROTATED (maxAccessKeyAge parameter, e.g. 90) Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran.
Assertions — what makes it a pass
| Field | Must be | For | Proves |
|---|---|---|---|
| access-keys-rotated.EvaluationResults | count_eq 0No active access key is older than the rule's maxAccessKeyAge. | every row | IA-05 |
| configuration-recorder-status.ConfigurationRecordersStatus[].recording | eq trueThe configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran. | every row | IA-05 |
| access-keys-rotated-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted | eq trueaccess-keys-rotated has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result. | every row | IA-05 |
| access-keys-rotated-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime | existsaccess-keys-rotated has a successful evaluation on record. | every row | IA-05 |
Authored opinion, like the commands. Units live in the operator name — max-age-days is days, and nothing here is converted for you.
Map — what it proves
- recipe1
Key Security Indicators
NIST 800-53 controls
- recipe— an authored recipe collects evidence for this control
- KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
- orphan— no Key Security Indicator reaches it — a person writes it up instead
What else these families can fetch:IA 6/30 →
GovCloud
AWS Config and this managed rule are available in AWS GovCloud (US); resource ARNs use partition arn:aws-us-gov
Notes & assertions
Strongest evidence for non-user auth is the absence of long-lived keys entirely (prefer IAM roles / temporary credentials). Where keys must exist, this rule proves rotation. Set maxAccessKeyAge to your policy (<=90d). The rule's verdict is only as strong as the maxAccessKeyAge an operator set, and the output does not carry the parameter — a human confirms it matches the SSP's rotation period. Root-user access keys are outside the rule by AWS's documented limitation. Filed under IA-05 base: key age tests IA-05 (g), not AC-02 (01).
References
- AWS Config managed rule: access-keys-rotated (ACCESS_KEYS_ROTATED, maxAccessKeyAge default 90 days; does not apply to root user access keys) https://docs.aws.amazon.com/config/latest/developerguide/access-keys-rotated.html
This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.
The Identity and Access Management run (16)
- automatable
- partial — needs judgement
- narrative — no API proves this
Every authored recipe filed under IAM, in the order the plan works them. The mark says how much of the evidence the command produces on its own.
- partialAccount-wide credential report proving MFA is active per principal and that passwords/access keys are rotated within policymonthlyiam-credential-reportIAM
- partialFull snapshot of every IAM user, group, role, and attached/inline policy with their relationships, used to review that granted permissions match least-privilege intentquarterlyiam-account-authorization-detailsIAM
- partialActive unused-access findings identifying IAM roles, access keys, console passwords, and service/action-level permissions that have not been used within the configured age, driving right-sizing and removalcontinuousiam-access-analyzer-unused-accessIAM Access Analyzer
- partialAWS Config compliance result for the managed rule proving every IAM user with a console password has MFA enabledcontinuousconfig-mfa-enabled-console-accessAWS Config · IAM
- partialAWS Config compliance result proving long-lived IAM access keys (including those used by service/non-user identities) are rotated within the maximum ageyou are herecontinuousconfig-access-keys-rotatedAWS Config · IAM
- partialAWS Config compliance result proving no customer-managed IAM policy grants full administrative access (Allow Action:* on Resource:*)continuousconfig-iam-policy-no-admin-accessAWS Config · IAM
- narrativeDocumented just-in-time / break-glass privilege-elevation process backed by IAM Identity Center permission sets and account assignments, showing privileged access is role/attribute-based, time-bound, and approval-gated rather than standingquarterlyidentity-center-jit-elevation-workflowIAM Identity Center
- partialGuardDuty IAM/credential-abuse findings (detection) paired with CloudTrail records of the responsive action taken to disable or secure the affected privileged principalcontinuousguardduty-suspicious-iam-activity-responseGuardDuty · CloudTrail · IAM
- partialHow operators actually reach the environment from outside it: the managed access paths that exist, the logging and encryption configured on them, the session-by-session record of who used them, and the negative check that no instance is directly reachable insteadweeklyremote-access-authorization-and-monitoringAWS Systems Manager Session Manager · AWS Client VPN · AWS Config · Amazon EC2
- partialEvery way a workforce user can authenticate into the account, counted and named in one pass — how many IAM users and federated trusts exist, which SAML and OIDC providers are registered, whether an IAM Identity Center instance is the workforce entry path — together with the state of the two credentials that belong to no person: the root user's access key and the account's X.509 signing certificatemonthlyidentity-sources-and-root-credential-lockdownAWS IAM · AWS IAM Identity Center · AWS Config
- partialFor every Amazon Cognito directory that fronts non-organizational users: the user pool's multi-factor configuration, and every identity pool's guest-access flag together with the named external providers it will exchange a token forweeklycognito-external-user-authenticationAmazon Cognito · AWS IAM
- partialThe configured ceiling on how long any credential stays valid before its holder must present an authenticator again — MaxSessionDuration on every IAM role, SessionDuration on every IAM Identity Center permission set, and the aws:MultiFactorAuthAge conditions in policy that expire an MFA-backed session independently of the session itselfquarterlysession-lifetime-and-reauthenticationAWS IAM · AWS IAM Identity Center · AWS STS
- partialThe mechanism that ends a temporary or emergency account without anyone deciding to: the AWS Config rule that measures how long an IAM credential has gone unused, the period it is configured with, the remediation configuration proving the revocation fires automatically, and an empty non-compliant set showing nothing has outlived the periodcontinuoustemporary-account-automatic-revocationAWS Config · AWS IAM · AWS Systems Manager Automation
- partialEvery identifier the account has issued, with the date it was assigned and the AWS-generated unique id behind it; the workforce identifiers issued through IAM Identity Center and the external issuer each one came from; and the CloudTrail record of identifiers being deleted, which is the only dated evidence of a name becoming free to reusecontinuousidentifier-assignment-and-reuse-preventionAWS IAM · AWS IAM Identity Center · AWS CloudTrail
- partialThe state of every credential in the account as of a stated moment, the enabled-or-disabled status of every workforce identity in the identity store, and the CloudTrail record of the revocations themselves — the five API calls that actually revoke standing access, each with the time it happened and the administrator who did itcontinuouspersonnel-separation-access-revocationAWS IAM · AWS IAM Identity Center · AWS CloudTrail
- partialWhat a transferred individual can still reach, and what they have actually used: the reassignment events themselves from CloudTrail (group membership, attached policy, and Identity Center account-assignment changes, each with its time and the administrator who made it), the current Identity Center assignments per permission set, and IAM's service-last-accessed report for the identities involved — a per-principal view of which services the identity is permitted to reach and which of those it has never authenticated to. `iam-access-analyzer-unused-access` answers the same question estate-wide from findings; this answers it for the named principal a transfer is about.continuouspersonnel-transfer-access-reassignmentAWS IAM · AWS IAM Identity Center · AWS CloudTrail