--- title: What happens when the agent is long gone, but its access... description: AWS IAM user access keys never expire automatically, so credentials created for AI agents can stay active long after the agent or project is gone. The piece... canonical: https://daily.dev/posts/what-happens-when-the-agent-is-long-gone-but-its-access-key-lives-on--cu2ktfo1e twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What happens when the agent is long gone, but its access key lives on? | daily.dev og:description: AWS IAM user access keys never expire automatically, so credentials created for AI agents can stay active long after the agent or project is gone. The piece... og:url: https://daily.dev/posts/what-happens-when-the-agent-is-long-gone-but-its-access-key-lives-on--cu2ktfo1e og:image: https://api.daily.dev/og/posts/Cu2ktfo1E.png og:image:alt: What happens when the agent is long gone, but its access key lives on? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What happens when the agent is long gone, but its access key lives on? **[The New Stack](https://daily.dev/sources/newstack)** · 10 min read · 1 upvotes · 0 comments ## Summary AWS IAM user access keys never expire automatically, so credentials created for AI agents can stay active long after the agent or project is gone. The piece gives a ClickHouse query using CloudQuery's aws_iam_credential_reports table to find active keys at least 90 days old and unused for 90 days, plus a PostgreSQL version. It also shows an Open Policy Agent rule for env zero that blocks Terraform plans from creating long-lived credentials like aws_iam_access_key, and recommends environment TTLs to force teardown. A GreyNoise campaign against PaperCut servers reached remote code execution in under four hours and compromised eleven organizations in 26 seconds, showing how fast exposed access gets exploited. env zero's Free plan offers 250 runs a month and 30 active environments. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I find AWS IAM access keys that are old and unused with a SQL query? A query against CloudQuery's aws_iam_credential_reports table can find them by taking the latest synced report per user, unpivoting the two access-key slots into rows, and filtering for keys that are active, at least 90 days old, and either never used or unused for at least 90 days. Versions are given for both the ClickHouse dialect and PostgreSQL, the latter using DISTINCT ON instead of LIMIT 1 BY. _Teams auditing AI agent credentials can track IAM governance writeups like this on daily.dev._ ### How do I stop Terraform from creating long-lived AWS IAM access keys in CI/CD? An Open Policy Agent rule can deny Terraform or OpenTofu plans that create resources like aws_iam_access_key, google_service_account_key, or azuread_application_password by checking resource_changes for a 'create' action on a defined set of credential resource types. It must include an explicit allow rule when count(deny) == 0, since a policy returning nothing otherwise leaves every deployment pending. _Platform engineers locking down credential creation in CI/CD can follow infrastructure policy patterns like this on daily.dev._ ### Why do AWS IAM user access keys never expire automatically? AWS does not assign IAM user access keys any expiration date, so a key stays valid indefinitely until someone manually deactivates or deletes it. This means a forgotten key from a completed project or decommissioned agent remains a valid credential that an attacker can use without it ever being flagged as orphaned, since nothing in AWS itself enforces a lifespan. _Anyone responsible for IAM hygiene can keep up with credential lifecycle practices like this via daily.dev._ ## Similar posts on daily.dev - [Your AI agent just provisioned a resource. Who owns it?](https://daily.dev/posts/your-ai-agent-just-provisioned-a-resource-who-owns-it--cx9pu5e45) · The New Stack · 0 upvotes · 0 comments - [AI Coding Agent Horror Stories: The 13-Hour AWS Outage](https://daily.dev/posts/ai-coding-agent-horror-stories-the-13-hour-aws-outage-zosxjzyng) · Docker · 17 upvotes · 5 comments - [AI Agents with Cloud Credentials Are Outrunning Billing Guardrails Built for Human-Speed Mistakes](https://daily.dev/posts/ai-agents-with-cloud-credentials-are-outrunning-billing-guardrails-built-for-human-speed-mistakes-kg4m43ten) · InfoQ · 1 upvotes · 0 comments - [Short-Lived Credentials in Agentic Systems: A Practical Trade-off Guide](https://daily.dev/posts/short-lived-credentials-in-agentic-systems-a-practical-trade-off-guide-h0cal49yt) · GitGuardian · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#iam](https://daily.dev/tags/iam), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/what-happens-when-the-agent-is-long-gone-but-its-access-key-lives-on--cu2ktfo1e) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What happens when the agent is long gone, but its access key lives on?","url":"https://daily.dev/posts/what-happens-when-the-agent-is-long-gone-but-its-access-key-lives-on--cu2ktfo1e","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-happens-when-the-agent-is-long-gone-but-its-access-key-lives-on--cu2ktfo1e"},"datePublished":"2026-10-28T14:04:41.197Z","dateModified":"2026-10-28T14:58:07.515Z","description":"AWS IAM user access keys never expire automatically, so credentials created for AI agents can stay active long after the agent or project is gone. The piece...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/456ce4fd3d01b3bd18c8628bc7b77d60?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/456ce4fd3d01b3bd18c8628bc7b77d60?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The New Stack","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The New Stack","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/newstack","url":"https://daily.dev/sources/newstack"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-happens-when-the-agent-is-long-gone-but-its-access-key-lives-on--cu2ktfo1e","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws,iam,secrets-management","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The New Stack","item":"https://daily.dev/sources/newstack"},{"@type":"ListItem","position":3,"name":"What happens when the agent is long gone, but its access key lives on?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-happens-when-the-agent-is-long-gone-but-its-access-key-lives-on--cu2ktfo1e#faq","mainEntity":[{"@type":"Question","name":"How can I find AWS IAM access keys that are old and unused with a SQL query?","acceptedAnswer":{"@type":"Answer","text":"A query against CloudQuery's aws_iam_credential_reports table can find them by taking the latest synced report per user, unpivoting the two access-key slots into rows, and filtering for keys that are active, at least 90 days old, and either never used or unused for at least 90 days. Versions are given for both the ClickHouse dialect and PostgreSQL, the latter using DISTINCT ON instead of LIMIT 1 BY. Teams auditing AI agent credentials can track IAM governance writeups like this on daily.dev."}},{"@type":"Question","name":"How do I stop Terraform from creating long-lived AWS IAM access keys in CI/CD?","acceptedAnswer":{"@type":"Answer","text":"An Open Policy Agent rule can deny Terraform or OpenTofu plans that create resources like aws_iam_access_key, google_service_account_key, or azuread_application_password by checking resource_changes for a 'create' action on a defined set of credential resource types. It must include an explicit allow rule when count(deny) == 0, since a policy returning nothing otherwise leaves every deployment pending. Platform engineers locking down credential creation in CI/CD can follow infrastructure policy patterns like this on daily.dev."}},{"@type":"Question","name":"Why do AWS IAM user access keys never expire automatically?","acceptedAnswer":{"@type":"Answer","text":"AWS does not assign IAM user access keys any expiration date, so a key stays valid indefinitely until someone manually deactivates or deletes it. This means a forgotten key from a completed project or decommissioned agent remains a valid credential that an attacker can use without it ever being flagged as orphaned, since nothing in AWS itself enforces a lifespan. Anyone responsible for IAM hygiene can keep up with credential lifecycle practices like this via daily.dev."}}]} ```