🛡️ AWS IAM SSH Public Key are not rotated every 90 days or less🟢

• Contextual name: 🛡️ SSH Public Key are not rotated every 90 days or less🟢
• ID: /ce/ca/aws/iam/ssh-public-keys-are-not-rotated-every-90-days
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 AWS IAM SSH Public Key
  • 🔌 AWS IAM SSH Public Key - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• Cloud Conformity: SSH Public Keys Rotated 90 Days

Description

Open File

Description

Identify AWS IAM SSH public keys that have been active for more than 90 days without rotation.

Ensure that all IAM SSH public keys are rotated at least every 90 days to reduce the risk of accidental exposure and to protect AWS CodeCommit repositories from unauthorized access.

Rationale

IAM SSH public keys are used to authenticate users for programmatic access to services such as AWS CodeCommit. Similar to passwords and access keys, these credentials should be rotated regularly. Regular key rotation limits the amount of time a compromised key can be used to access source code repositories.

Audit

This policy flags an AWS IAM SSH Public Key as INCOMPLIANT if the Upload Date is older than 90 days.

An AWS IAM SSH Public Key is marked as INAPPLICABLE if its Status is not set to Active.

Remediation

Open File

Remediation

Rotate IAM SSH Public Key

Rotate IAM SSH public keys that have exceeded the recommended rotation period by creating a new key, updating dependent configurations, and removing the outdated key.

From Command Line

1. Generate and upload a new SSH public key

   Run the upload-ssh-public-key command to upload the new SSH public key (PEM or SSH-RSA format) for the specified IAM user:

   aws iam upload-ssh-public-key \
       --region {{region}} \
       --user-name {{user-name}} \
       --ssh-public-key-body file://{{sshkey.pub}}
       --query SSHPublicKey.SSHPublicKeyId

   Note the SSH Public Key ID returned by this command. It will be required in subsequent steps.

2. Update AWS CodeCommit SSH configuration

   Replace the existing SSH Key ID in your CodeCommit SSH configuration with the newly generated key ID, then validate access to your repositories.

   Example configuration:

   Host git-codecommit.*.amazonaws.com
       User {{ssh-key-id}}
       IdentityFile {{private-key-file}}

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 AWS Well-Architected → 💼 SEC02-BP02 Use temporary credentials			1		no data
💼 Cloudaware Framework → 💼 Credential Lifecycle Management			23		no data