4 ms·

> Following this revelation, we were able to observe that these keys change on an hourly basis... Is it recommended to rotate keys hourly, or even daily? Or on

> Following this revelation, we were able to observe that these keys change on an hourly basis... Is it recommended to rotate keys hourly, or even daily? Or only for something like AWS - I've read/been told monthly is more than adequate for reg. web apps

mozman 2y ago
you should provision jit creds via sts - I think default session length if 1hr. dont use hard coded keys and use IRSA.
watermelon0 2y ago
When possible, you should not use IAM user long-term credentials. Inside AWS, temporary security credentials via STS should be used. Outside AWS, OIDC federation should be used. Users should use SSO.