Declared IAM access key should have a documented rotation plan

What it checks

IAM access key: this declaration manages a long-term credential.

Where it applies

Terraform: aws_iam_access_key

CloudFormation: AWS::IAM::AccessKey

How to fix it

1. Evaluate whether OIDC federation (for CI/CD) or an IAM role (for AWS services) can replace the key.
2. If a key is required, protect its secret delivery and storage, automate safe consumer migration, and document 90-day rotation in the runbook. Terraform-created keys can use pgp_key; CloudFormation keys can be replaced by incrementing Serial.

Vendor documentation

All rules