Help Center/ Identity and Access Management_Identity and Access Management (New Edition)/ API Reference/ Example Applications/ Periodic Rotation of Access Keys
Updated on 2025-11-06 GMT+08:00
View PDF
Share

Periodic Rotation of Access Keys

Scenario

Enterprise users usually use access keys (AK/SKs) to access cloud resources through APIs. They are advised to make access keys automatically rotate to reduce potential security risks.

This section guides you through rotating access keys by calling APIs. You can also automate rotation of access keys using programmatic methods.

General Procedure

The following steps are involved to periodically rotate your access keys:

  1. Create an access key.
  2. Query the time when all of your access keys are created, and determine whether they need to be rotated.
  3. Create an access key.
  4. Delete the old access key.

The following APIs will be used in this example:

Step 1: Create a Permanent Access Key

URI: POST /v5/users/{user_id}/access-keys

For details about the API, see Creating a Permanent Access Key.

  • Example Request 
    POST https://{endpoint}/v5/users/07609fb9358010e21f7bc003751.../access-keys
  • Example Response 
    { 
  "access_key" : { 
    "user_id" : "07609fb9358010e21f7bc003751...", 
    "access_key_id" : "P83EVBZJMXCYTMUII...", 
    "created_at" : "2023-09-13T06:51:20.550Z", 
    "secret_access_key" : "TTqAHPbhWorg9ozx8Dv9MUyzYnOKDppxzHt...", 
    "status" : "active" 
  } 
}

Step 2: Query the Creation Time of All Access Keys

URI: GET /v5/users/{user_id}/access-keys

For details about the API, see Querying Permanent Access Keys.

  • Example Request 
    GET https://{endpoint}/v5/users/07609fb9358010e21f7bc003751.../access-keys
  • Example Response 
    { 
  "access_keys" : [ { 
    "user_id" : "07609fb9358010e21f7bc003751...", 
    "access_key_id" : "P83EVBZJMXCYTMUII...", 
    "created_at" : "2023-09-13T06:51:20.550Z", 
    "status" : "active" 
  } ], 
  "page_info" : {  
    "current_count" : 1 
  } 
}

Step 3: Create a New Access Key

Repeat Step 1: Create a Permanent Access Key.

Step 4: Delete the Old Access Key

URI: DELETE /v5/users/{user_id}/access-keys/{access_key_id}

For details about the API, see Deleting a Permanent Access Key.

  • Example Request 
    DELETE https://{endpoint}/v5/users/07609fb9358010e21f7bc003751.../access-keys/P83EVBZJMXCYTMUII...
  • Example Response

    This API does not have a response body. If the status code 204 is displayed, the access key is deleted successfully.

Parent topic: Example Applications