Rotating IAM credentials using Boto3

Rotating an access key (including access key IDs and secret access keys) regularly is a security best practice. It reduces the blast radius of damage if the security key is compromised.

Note

AWS strongly recommends the use of IAM roles as it uses temporary security credentials. STS will automatically take care of rotating and expiring those credentials, so we don't need to worry about this. However, in cases where our application runs somewhere other than EC2, we need to add key rotation as part of the application life cycle.

Prerequisites

Before executing the Boto3 script, please create a new key for the user, in addition to the one that is in use. IAM only allows two access keys. Before generating a new key for the user, we need to list the existing keys; if the user already has two keys, our Boto3 script will fail if we try to generate a new key (third key). Listing a key is an important step as it will provide us with a safety...