---
title: "AWS Access Key and Secret Key: Create, Rotate, Share Safely"
url: https://uselinkpilot.com/blog/aws-access-key-and-secret-key
description: "What an AWS access key ID and secret access key are, why the secret shows once, how to rotate them, what to do after a leak, and how to share one safely."
lang: en
---

Security (https://uselinkpilot.com/blog/category/security)

# AWS access key and secret key: how to create, use, rotate and share them safely

What an AWS access key ID and secret access key are, why the secret shows once, how to rotate them, what to do after a leak, and how to share one safely.

LinkPilot Team (https://uselinkpilot.com/author/linkpilot-team) · The people who build and run LinkPilot at TetraCore, LLC October 26, 2026 · About LinkPilot (https://uselinkpilot.com/about)

An AWS access key is two strings that together let a program act as an IAM user: the access key ID, which identifies the key, and the secret access key, which proves it. People search for them under three names, access key and secret key, secret access key, and just AWS secret key, and they are all the same pair. The pair turns up in CLI configs, CI pipelines, and far too often in a Slack message.

This guide covers what the two halves are, how to create and configure them, how to rotate without downtime, what to do when one leaks, and the question that comes up every time a developer joins or a contractor starts: how to hand a secret key to a person without putting it in email.

## Access key ID versus secret access key

| | Access key ID | Secret access key | | --- | --- | --- | | Looks like | `AKIAIOSFODNN7EXAMPLE` (20 characters) | 40 characters of mixed case and symbols | | Role | Identifies which key is signing the request | Signs the request; proves possession | | Secret? | No, treat it like a username | Yes, treat it like a password | | Visible later? | Yes, in the IAM console | Never after creation |

Long-term keys start with `AKIA`. Temporary credentials from STS, which also come with a session token, start with `ASIA` and expire on their own. If you see an `ASIA` key in a config file, it will stop working within hours, which is the design.

Neither half grants permissions. The key authenticates as an IAM user, and the user's attached policies decide what that identity can do. A leaked key on a read-only user is a problem. A leaked key on an administrator is an incident.

## When you need a long-term key at all

The honest answer is less often than people think.

- **Workloads on AWS** (EC2, Lambda, ECS, EKS) should use IAM roles. The SDK (https://uselinkpilot.com/glossary#sdk) picks up short-lived credentials automatically and there is nothing to rotate or leak.
- **People** should sign in through IAM Identity Center or federated SSO (https://uselinkpilot.com/glossary#single-sign-on) and get temporary credentials from `aws sso login`.
- **CI systems** such as GitHub Actions can assume a role through OIDC with no stored key.
- **Long-term keys** are left for the cases that cannot do any of the above: a tool on a laptop that lacks SSO support, a third-party service that only accepts static keys, a legacy job you have not migrated yet.

If you do need one, create it on a dedicated IAM user with the narrowest policy that does the job, and never on a human's administrator account.

## Create and configure a key

In the IAM console, open the user, choose Security credentials, then Create access key. Pick the use case AWS asks about, read the alternative it suggests, and continue. The secret is shown exactly once. Save it straight into your secret store or password manager, or download the CSV and delete it after import. Each IAM user can hold at most two keys at a time, which is what makes rotation possible.

On a machine, configure a named profile rather than the default:

```bash
aws configure --profile deploy-tool
# AWS Access Key ID [None]: AKIA...
# AWS Secret Access Key [None]: ...
# Default region name [None]: eu-west-1
```

That writes `~/.aws/credentials` and `~/.aws/config`. Lock the file to your user with `chmod 600`. For containers and CI, inject `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` as secrets from the platform's store, not as plain variables in a YAML file, and never pass them on a command line where they land in shell history.

## Rotate without breaking anything

Rotation is a four-step dance, made possible by the two-key limit.

1. **Create the second key** on the same user.
2. **Update every consumer** to the new key: configs, CI secrets, the secrets manager entry. The IAM console shows each key's last used time, which tells you whether you missed one.
3. **Deactivate the old key.** Wait a day or a deploy cycle. If something breaks, reactivate it, fix the consumer, try again.
4. **Delete the old key** once nothing has used it.

Do this on a schedule for keys that must exist, and on events for all of them: a departure, a vendor change, a laptop lost, a suspected leak. AWS Config and IAM Access Analyzer can flag keys older than your policy allows.

## When a key is exposed

Treat a key that appeared in a repository, a log, a ticket or a chat as compromised, even if it was deleted a minute later. Scanners find pushed secrets in seconds.

1. **Deactivate the key** in IAM now. Do not wait to create the replacement first unless the outage would be worse than the exposure.
2. **Create a replacement** and update the consumers.
3. **Read CloudTrail** for every action made with that access key ID since the exposure. Look for new IAM users or keys, new instances, changed bucket policies and unfamiliar regions.
4. **Check the bill** and Cost Explorer for crypto-mining-shaped spikes.
5. **Remove the secret** from code, logs and git history. AWS may attach the `AWSCompromisedKeyQuarantine` policy to the user itself when it detects a public leak; leave that in place until the cleanup is done.
6. **Delete the old key**, then find out how it got there and close that path.

## How to share an AWS secret key with a person

Sometimes the key has to reach a human: a contractor who needs it for a deployment tool, a developer joining a project before SSO is set up, a vendor integration that wants it pasted into their dashboard. Email, Slack and tickets all keep copies, and a 40-character secret in any of them is readable for years.

The safe routine takes a minute:

1. **Create a key for that person** on a dedicated IAM user with the policy their task needs and nothing more. Do not share a key that anything else uses.
2. **Paste only the secret access key** into a one-time secret link (https://uselinkpilot.com/tools/free-secret-link-generator). It is encrypted in your browser before it is stored, the stored copy is destroyed the first time the link is opened, and the link expires after an hour, a day or a week if nobody opens it.
3. **Send the link** with one line of context. Send the access key ID, the region and the profile name in a separate message; none of those is secret on its own.
4. **Add a passphrase on a Pro account** for anything beyond read-only, and pass it on by text or on a call.
5. **Confirm they opened it.** If the link says it was already viewed and they did not open it, deactivate the key and start over.
6. **Deactivate the key** when the engagement ends, and delete it after.

The API key guide (https://uselinkpilot.com/blog/how-to-share-api-keys-securely) has the same pattern for other providers, and secure link sharing for developers (https://uselinkpilot.com/blog/secure-link-sharing-for-developers) covers scripting the handoff for onboarding.

## Related reading

- How to share API keys securely: https://uselinkpilot.com/blog/how-to-share-api-keys-securely
- Cloud secret manager: what it is and how to choose one: https://uselinkpilot.com/blog/cloud-secret-manager
- How to send a temporary database login to a contractor securely: https://uselinkpilot.com/blog/how-to-send-a-temporary-database-login-to-a-contractor-securely
- How one-time secret links work: https://uselinkpilot.com/blog/how-one-time-secret-links-work

## Tools for this article

One-Time Secret Link Generator

Share a password or note through a link that opens once.
https://uselinkpilot.com/tools/free-secret-link-generator

Self-Destructing Message

Send a note that disappears after one read.
https://uselinkpilot.com/tools/burn-after-read-secret

Expiring Link Generator

Create links that stop working at a set time.
https://uselinkpilot.com/tools/temporary-link

## Frequently asked questions

### Can I see my AWS secret access key again after creating it?

### Is the access key ID the same as the secret access key?

### Where do I find an existing access key ID?

### Do access keys grant permissions by themselves?

### Should I deactivate a key before deleting it?

### What should I do if an AWS access key is exposed?

## LinkPilot sends a secret link that is gone after it is opened.

Encrypted in your browser, revealed once, then destroyed. No account needed.

Create a secret link (https://uselinkpilot.com/tools/free-secret-link-generator)

## Read next

Security

### How to Share SSH Credentials With a Link That Expires (Securely)

Prefer the recipient's public key. When a private key or password must move, send it as a one-time link that expires and send the host and username separately.
https://uselinkpilot.com/blog/how-to-share-ssh-credentials-with-a-link-that-expires-securely

Security

### How to Share Credentials Securely Without Email

Four ways to share a password without email, when each one fits, and a step-by-step for a temporary link for sharing login details that burns after one open.
https://uselinkpilot.com/blog/how-to-share-credentials-securely-without-email

Security

### How to Send a Webhook Signing Secret to a Client Securely

Hand a webhook signing secret to a client without leaving copies in email or tickets: verify the recipient, send a one-time link, store it right, rotate if exposed.
https://uselinkpilot.com/blog/how-to-send-a-webhook-signing-secret-to-a-client-securely

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": "SoftwareApplication",
    "@id": "https://uselinkpilot.com/#software",
    "name": "LinkPilot",
    "applicationCategory": "BusinessApplication",
    "operatingSystem": "Web",
    "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.",
    "url": "https://uselinkpilot.com",
    "offers": [
      {
        "@type": "Offer",
        "name": "Free",
        "price": "0",
        "priceCurrency": "USD",
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Pro",
        "price": "29",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "29",
          "priceCurrency": "USD",
          "billingDuration": "P1M"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Agency",
        "price": "299",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "299",
          "priceCurrency": "USD",
          "billingDuration": "P1M"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Agency Plus",
        "price": "799",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "799",
          "priceCurrency": "USD",
          "billingDuration": "P1M"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Enterprise",
        "priceSpecification": {
          "@type": "PriceSpecification",
          "priceCurrency": "USD"
        },
        "url": "https://uselinkpilot.com/pricing"
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "https://uselinkpilot.com/#organization",
    "name": "LinkPilot",
    "alternateName": "LinkPilot by TetraCore",
    "url": "https://uselinkpilot.com",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "support@uselinkpilot.com",
      "url": "https://uselinkpilot.com/support"
    },
    "parentOrganization": {
      "@type": "Organization",
      "@id": "https://tetracorehq.com/#organization",
      "name": "TetraCore",
      "url": "https://tetracorehq.com/"
    },
    "logo": {
      "@type": "ImageObject",
      "url": "https://uselinkpilot.com/logo-512.png",
      "width": 512,
      "height": 512
    },
    "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.",
    "sameAs": [
      "https://x.com/uselinkpilot",
      "https://www.linkedin.com/company/uselinkpilot",
      "https://facebook.com/uselinkpilot",
      "https://github.com/TetraCoreHQ/linkpilot-cli",
      "https://github.com/TetraCoreHQ/linkpilot-mcp",
      "https://www.npmjs.com/package/linkpilot",
      "https://www.npmjs.com/package/@uselinkpilot/sdk",
      "https://www.npmjs.com/package/@uselinkpilot/mcp",
      "https://chromewebstore.google.com/detail/linkpilot-short-links-and/mnmppadihpcncicldpkmgknhnjkondad"
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "WebSite",
    "name": "LinkPilot",
    "url": "https://uselinkpilot.com",
    "potentialAction": {
      "@type": "SearchAction",
      "target": "https://uselinkpilot.com/blog?q={search_term_string}",
      "query-input": "required name=search_term_string"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "position": 1,
        "name": "Home",
        "item": "https://uselinkpilot.com/"
      },
      {
        "@type": "ListItem",
        "position": 2,
        "name": "Blog",
        "item": "https://uselinkpilot.com/blog"
      },
      {
        "@type": "ListItem",
        "position": 3,
        "name": "AWS Access Key and Secret Key: How to Create, Use, Rotate and Share Them Safely",
        "item": "https://uselinkpilot.com/blog/aws-access-key-and-secret-key"
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "BlogPosting",
    "@id": "https://uselinkpilot.com/blog/aws-access-key-and-secret-key#article",
    "headline": "AWS Access Key and Secret Key: How to Create, Use, Rotate and Share Them Safely",
    "description": "What an AWS access key ID and secret access key are, why the secret shows once, how to rotate them, what to do after a leak, and how to share one safely.",
    "datePublished": "2026-10-26",
    "dateModified": "2026-10-26",
    "image": "https://uselinkpilot.com/logo-512.png",
    "author": {
      "@type": "Organization",
      "@id": "https://uselinkpilot.com/author/linkpilot-team#organization",
      "name": "LinkPilot Team",
      "url": "https://uselinkpilot.com/author/linkpilot-team"
    },
    "publisher": {
      "@type": "Organization",
      "name": "LinkPilot",
      "url": "https://uselinkpilot.com",
      "logo": {
        "@type": "ImageObject",
        "url": "https://uselinkpilot.com/logo-512.png",
        "width": 512,
        "height": 512
      }
    },
    "mainEntityOfPage": {
      "@type": "WebPage",
      "@id": "https://uselinkpilot.com/blog/aws-access-key-and-secret-key"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "FAQPage",
    "mainEntity": [
      {
        "@type": "Question",
        "name": "Can I see my AWS secret access key again after creating it?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "No. AWS shows the secret access key once, at creation, and never again. If it was not saved, deactivate that key and create a new one. The access key ID stays visible in the IAM console."
        }
      },
      {
        "@type": "Question",
        "name": "Is the access key ID the same as the secret access key?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "No. The access key ID is a public identifier, like a username, and starts with AKIA for long-term keys. The secret access key is the password half and must stay confidential. Requests are signed with both."
        }
      },
      {
        "@type": "Question",
        "name": "Where do I find an existing access key ID?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "In the IAM console, under the user, on the Security credentials tab. The secret for an existing key is not retrievable, only the ID, its status and when it was last used."
        }
      },
      {
        "@type": "Question",
        "name": "Do access keys grant permissions by themselves?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "No. A key authenticates as the IAM user it belongs to. What it can do is whatever the IAM policies attached to that user allow. A key with no policies can do nothing; a key on an administrator can do everything."
        }
      },
      {
        "@type": "Question",
        "name": "Should I deactivate a key before deleting it?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Yes. Deactivate first, wait long enough to see that nothing broke, then delete. A deactivated key can be turned back on; a deleted one cannot."
        }
      },
      {
        "@type": "Question",
        "name": "What should I do if an AWS access key is exposed?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Deactivate it immediately in IAM, create a replacement and update whatever used it, review CloudTrail for actions taken with the exposed key, check for new resources or IAM changes, and remove the key from code, logs and commit history. Then look at how it leaked."
        }
      }
    ]
  }
]
```