🔐 Rotating AWS Access Keys and SMTP Credentials — A Practical Guide

Last updated: October 2025

Regular rotation of AWS access keys is one of the simplest and most effective ways to protect your cloud environment from unauthorized access. This guide explains why rotation matters, how to do it safely, and how to handle Amazon SES SMTP credentials, which have a few extra steps compared to standard IAM keys.

🧭 Why You Should Rotate Keys

AWS access keys are effectively passwords for your infrastructure. If they’re leaked—through code commits, logs, or third-party services—they can be used to:

• Access sensitive S3 buckets
• Send unauthorized emails through SES
• Deploy resources and incur charges
• Exfiltrate data or damage systems

Regular rotation limits the exposure window of any compromised key and helps meet security compliance requirements.

📅 How Often to Rotate Keys

AWS’s own guidance: rotate at least every 90 days and immediately after any suspected exposure.

🛠 Step-by-Step: Rotating an IAM Access Key

1. Create a new key

• Go to IAM → Users → [User] → Security credentials
• Click Create access key
• Copy the Access Key ID and Secret Access Key immediately.

2. Update your applications

Replace the old key with the new one in:

• Environment variables (.env)
• CI/CD pipelines
• SDK configurations or secret managers
• Any integrations using this key

3. Test the update

• Run basic operations (e.g., S3 upload, SES send)
• Check logs for authentication failures

4. Deactivate and delete the old key

• Deactivate the old key once the new one is verified.
• Wait a safe grace period if needed.
• Delete the old key permanently.

✉️ SES SMTP Credentials Require an Extra Step

SES SMTP credentials are derived from the IAM secret key but are not identical to it.

• SMTP username = IAM Access Key ID
• SMTP password = a special HMAC-derived password, generated at creation

To rotate SES SMTP credentials:

1. Go to SES → SMTP settings
2. Click Create SMTP credentials (or generate via script)
3. Note the SMTP username and password (password is shown once).
4. Update your mail configuration:

MAIL_MAILER=smtp
MAIL_HOST=email-smtp.us-east-1.amazonaws.com
MAIL_PORT=587
MAIL_USERNAME=AKIAxxxxxxxxxxxx
MAIL_PASSWORD=SMTP_PASSWORD
MAIL_ENCRYPTION=tls

1. Test sending email, then deactivate and delete the old key.

🧭 Managing Multiple SMTP Keys

If multiple apps or systems use SES:

• Create dedicated IAM users per app or function (e.g., app1-smtp, marketing-smtp)
• Tag each user in IAM with:app = app1
  type = smtp
  environment = production
  
• This makes it easy to filter and rotate keys by purpose.

👉 Remember: SMTP passwords are never visible again after creation. If lost, generate a new key.

🛡 Security Best Practices

• Keep only one active key per IAM user at a time
• Use tags and naming conventions for clarity
• Rotate immediately if a credential is suspected compromised
• Store keys in AWS Secrets Manager or equivalent
• Restrict IAM policies to the minimum required (e.g., limit ses:FromAddress)
• Automate rotation when possible (e.g., through Lambda or CLI scripts)

⚡ Automating Key Rotation

For teams that want to minimize manual steps:

• Use AWS CLI or SDK to create new access keys programmatically.
• Store new credentials in Secrets Manager or Parameter Store.
• Automatically update applications or pipelines with the new key.
• Schedule this process at a defined interval (e.g., every 45 days).

✅ Summary

• Rotate IAM access keys at least every 90 days.
• For SMTP keys, use SES’s SMTP credential generator or HMAC script.
• Store keys securely, apply least privilege, and tag them clearly.
• Automate where possible to reduce human error.
• Regular rotation strengthens your security posture and limits the impact of key exposure.