Periodic Rotation of Access Keys

Scenario

Enterprise users usually use access keys (AK/SKs) to access cloud resources through APIs. They are advised to make access keys automatically rotate to reduce potential security risks.

This section guides you through rotating access keys by calling APIs. You can also automate rotation of access keys using programmatic methods.

Prerequisites

Before performing operations on the access keys of another IAM user as an administrator, ensure that you have been assigned the Security Administrator role. If you will perform operations on your own access keys as an IAM user, you do not need any special permissions assigned.

General Procedure

The following steps are involved to periodically rotate your access keys:

1. Create an access key.
2. Query the time when all of your access keys or a specified access key is created, and determine whether they need to be rotated.
3. Create a new access key.
4. Delete the old access key.

The following APIs will be used in this example:

• Creating a Permanent Access Key
• Listing Permanent Access Keys
• Querying a Permanent Access Key
• Deleting a Permanent Access Key

Step 1: Create a Permanent Access Key

URI: POST /v3.0/OS-CREDENTIAL/credentials

For details about the API, see Creating a Permanent Access Key.

• Example Request

  POST https://iam.myhuaweicloud.com/v3.0/OS-CREDENTIAL/credentials

  {
      "credential": {
          "description": "IAMDescription",
          "user_id": "07609fb9358010e21f7bc003751..."
      }
  }

• Example Response

  {
      "credential": {
          "access": "P83EVBZJMXCYTMUII...",
          "create_time": "2020-01-08T06:25:19.014028Z",
          "user_id": "07609fb9358010e21f7bc003751...",
          "description": "IAMDescription",
          "secret": "TTqAHPbhWorg9ozx8Dv9MUyzYnOKDppxzHt...",
          "status": "active"
      
  }

Step 2: Query the Creation Time of a Specified or All Access Keys

• Query the creation time of all access keys.

  URI: GET /v3.0/OS-CREDENTIAL/credentials

  For details about the API, see Querying Permanent Access Keys.

  • Example Request

    IAM user: Use the following API to query the creation time of all of your access keys.

    GET https://iam.myhuaweicloud.com/v3.0/OS-CREDENTIAL/credentials

    Administrator: Use the following API to query the creation time of all access keys of another IAM user. (076… indicates the ID of the user to query.)

    GET https://iam.myhuaweicloud.com/v3.0/OS-CREDENTIAL/credentials?user_id=076...

  • Example Response

    {
        "credentials": [
            {
                "access": "LOSZM4YRVLKOY9E8X...",
                "create_time": "2020-01-08T06:26:08.123059Z",
                "user_id": "07609fb9358010e21f7bc0037...",
                "description": "",
                "status": "active"
            },
            {
                "access": "P83EVBZJMXCYTMU...",
                "create_time": "2020-01-08T06:25:19.014028Z",
                "user_id": "07609fb9358010e21f7bc003751...",
                "description": "",
                "status": "active"
            }
        ]
    }

• Query the creation time of a specified access key.

  URI: GET /v3.0/OS-CREDENTIAL/credentials/{access_key}

  For details about the API, see Querying a Permanent Access Key.

  • Example Request

    GET https://iam.myhuaweicloud.com/v3.0/OS-CREDENTIAL/credentials/{access_key}

  • Example Response

    {
        "credential": {
            "last_use_time": "2020-01-08T06:26:08.123059Z",
            "access": "LOSZM4YRVLKOY9E8...",
            "create_time": "2020-01-08T06:26:08.123059Z",
            "user_id": "07609fb9358010e21f7bc00375....",
            "description": "",
            "status": "active"
        }
    }

Step 3: Create a New Access Key

Repeat Step 1: Create a Permanent Access Key.

Step 4: Delete the Old Access Key

URI: DELETE /v3.0/OS-CREDENTIAL/credentials/{access_key}

For details about the API, see Deleting a Permanent Access Key.