Loading page
About this tool
Plan rotation cadence and a safe cutover schedule for cloud service account keys, with due, overlap, disable and delete dates.
This planner turns a key's last rotation date and your chosen cadence into a dated, zero-downtime cutover schedule: notify owners, create the new key, deploy and verify during an overlap window, disable the old key on the due date, and delete it after a quarantine period. It applies the CIS AWS Foundations Benchmark ceiling of rotating access keys every 90 days or less, and works equally for AWS IAM access keys, GCP service account keys and Azure client secrets.
Open Service Account Key Rotation Planner on AltFTool — it loads instantly in your browser.
Add your input to the workspace.
Adjust the options until the result looks right.
Copy or download the output and put it to work.
Uses the two-active-keys overlap pattern so services never authenticate with a dead credential.
Flags any cadence longer than the CIS benchmark's 90-day maximum for access key rotation.
Schedules a quarantine window so a missed dependency can be re-enabled instead of lost.
The CIS AWS Foundations Benchmark (control 1.14) requires access keys to be rotated every 90 days or less, and auditors commonly apply the same 90-day ceiling to GCP service account keys and Azure client secrets. Shorter periods (30-60 days) reduce exposure further but multiply operational work, which is why automation or keyless identity is preferred at scale.
Create the new key while the old one is still active, deploy it through your secret store, verify traffic is authenticating with the new key ID, then disable the old key and delete it only after a quarantine period. This works because providers allow multiple concurrent keys — AWS permits 2 access keys per IAM user and GCP up to 10 keys per service account.
Disabling is reversible; deletion is not. If a forgotten cron job or legacy service was still using the old key, a disabled key can be re-enabled in seconds to restore service, whereas a deleted key forces an emergency re-issue. A 7-day disabled quarantine with log monitoring is a common operational default before permanent deletion.
Often, yes — replace static keys with short-lived credentials: IAM roles for EC2/Lambda, GCP workload identity federation, or Azure managed identities all issue automatically rotating tokens, and CI systems can use OIDC federation instead of stored secrets. Rotation planning should apply only to the residual keys that genuinely cannot be made keyless.