NIST SP 800-53 Rev. 5 · Identification and Authentication
IA-5(1) on AWS
Credentials past required rotation — a published SQL (Athena) + Lambda query you can run against Amazon Athena over the IAM credential report, with the evidence it needs, the settings you decide, and what a result does and does not establish.
Why this matters
A password or key still in use long past the date it should have been replaced
Applications and automated systems sign in using long-lived keys rather than passwords typed by a person. These are created once, pasted into a configuration file, and forgotten. They frequently outlast the project, the vendor, and the employee who created them, and a key that leaks stays useful to whoever finds it for as long as it remains valid.
Why this check earns its place. Nobody receives a reminder that an application key is ageing. There is no login prompt to nag anyone, so the only way to find them is to go looking.
- What it reads
- The organization's own inventory of application keys and when each was created.
- What it reports
- Keys older than the organization's own replacement interval, and keys about to stop working without warning.
See related public disclosures on the Signals page →
What this finds
Active credential older than the rotation interval, or approaching hard expiry.
The requirement
The organization must enforce authenticator lifetime restrictions and require authenticators to be changed or refreshed at an organization-defined frequency.
NIST SP 800-53 Rev. 5 — IA-5(1) (Authenticator Management | Password-Based Authentication).
NIST requires a defined refresh frequency without setting it. The 90-day rotation interval below, and any exemption for credentials managed by an automated rotation service, are local decisions.
How this maps to the CISA performance goals
The Cross-Sector Cybersecurity Performance Goals are a voluntary baseline published by CISA — the U.S. federal agency for critical-infrastructure cybersecurity — written for organizations too small to employ security staff. This control speaks to:
- 3.C — Create unique credentials (partial — see note)
CPG 2.0 has NO goal for credential rotation age. Current NIST guidance moved away from forced periodic rotation, so this pack answers an organization-defined policy rather than a CPG. Mapped here only because both concern credential hygiene -- do not present it as satisfying 3.C.
See the full coverage map, including the goals no query can answer →
Evidence this query needs
None. This query runs on platform telemetry alone — there is no file to prepare and nothing to export.
The query
Published as ia-5-1-credential-rotation.aws.sql. Reads iam_credential_report. Requires: iam:GenerateCredentialReport; iam:GetCredentialReport; athena:StartQueryExecution.
Before this returns anything,
iam_credential_report has to be reaching Amazon Athena over the IAM credential report. If not, the query reports nothing found — which looks
exactly like nothing wrong. What has to be switched on first →
-- IA-5(1) -- IAM access keys past the rotation interval
SELECT
user_name, arn,
'access_key_1' AS credential,
access_key_1_last_rotated AS last_rotated,
date_diff('day', access_key_1_last_rotated, current_date) AS age_days,
'AWS IAM' AS source_system
FROM iam_credential_report
WHERE access_key_1_active = true
AND date_diff('day', access_key_1_last_rotated, current_date) > 90
UNION ALL
SELECT
user_name, arn,
'access_key_2' AS credential,
access_key_2_last_rotated AS last_rotated,
date_diff('day', access_key_2_last_rotated, current_date) AS age_days,
'AWS IAM' AS source_system
FROM iam_credential_report
WHERE access_key_2_active = true
AND date_diff('day', access_key_2_last_rotated, current_date) > 90
ORDER BY age_days DESC;Open this pack on AWS to adjust the settings and download it →
The interactive version opens on AWS — the platform on this page — even if your environment profile does not list it.
Settings you decide
NIST states the objective and leaves these to your organization. The interactive version of this pack applies them to the query for you.
- Rotation interval (days) (default 90)
- Access keys older than this are reported. Applied to both key slots.
Running it continuously
EventBridge Scheduler → Lambda → Security Hub
Schedule: EventBridge Scheduler, rate(1 day)
Compute: Lambda (Python 3.12), 120s timeout
Step 1: Generate and retrieve the credential report
Step 2: Evaluate both key slots per user
Step 3: BatchImportFindings -> Security Hub
Severity label: MEDIUM
RelatedRequirements: NIST.800-53.r5 IA-5(1)
Idempotency: Id = sha256(user_arn + credential_slot)Both key slots are checked separately because a user rotating one key while leaving the other stale is a common and easily missed pattern.
What a result does not prove
Credential age alone does not indicate compromise. It indicates that the organization's own rotation requirement has not been evidenced for this credential.
Validation status for this platform: Not tenant-validated. Structure, query generation, and preflight are covered by the project's automated test suites. This pack has not been executed against a live tenant, account, or index. Validate it in a non-production scope before relying on any result.
Before you act on a result
- Is the credential under an automated rotation service this query does not see?
- Is the credential still in use, or is it an orphan that should be deleted rather than rotated?
- Would rotation break a dependency that needs coordinated change?
- Is there a documented exception with an expiry?
Common questions
- How do I check for credentials past required rotation in AWS?
- Run the published SQL (Athena) + Lambda query on this page against Amazon Athena over the IAM credential report. It reads iam_credential_report and reports: Active credential older than the rotation interval, or approaching hard expiry.
- What permissions are needed to run this AWS query?
- iam:GenerateCredentialReport; iam:GetCredentialReport; athena:StartQueryExecution.
- Does a result from this query mean the control has failed?
- Credential age alone does not indicate compromise. It indicates that the organization's own rotation requirement has not been evidenced for this credential.
Terms used on this page
- NIST SP 800-53the U.S. federal catalogue of security requirements
- The catalogue of security and privacy requirements published by the National Institute of Standards and Technology, a U.S. federal agency. U.S. government systems are measured against it, and many private organizations adopt it voluntarily. Each requirement has an identifier such as AC-2. Official source →
- CISACybersecurity and Infrastructure Security Agency
- The U.S. federal agency responsible for national critical-infrastructure cybersecurity. Its publications are works of the U.S. government and are free to use. Official source →
- CPGCross-Sector Cybersecurity Performance Goals
- A voluntary baseline of security practices published by the U.S. Cybersecurity and Infrastructure Security Agency, written specifically for organizations too small to employ security staff. It is a short, plainly written starting list rather than a full standard. Official source →
- not tenant-validatednever executed against real data
- The check has passed the project's automated tests for structure and syntax, but has never been run against real data anywhere. Test it in a safe scope before relying on any result.