OCI IAM API Keys Should Be Rotated Every 90 Days

oci iam user list --all --compartment-id <tenancy_ocid> \
  --query "data[?\"name\"=='<your_username>'].id | [0]" --raw-output

oci iam user api-key list \
  --user-id <user_ocid> \
  --query 'data[].{"keyId": "key-id", "timeCreated": "time-created"}' \
  --output table

mkdir -p ~/.oci/keys
cd ~/.oci/keys

# Generate new key pair (adjust file names as needed)
openssl genrsa -out new_api_key.pem 2048
openssl rsa -pubout -in new_api_key.pem -out new_api_key_public.pem

oci iam user api-key upload \
  --user-id <user_ocid> \
  --key-file new_api_key_public.pem \
  --query 'data."key-id"' \
  --raw-output

nano ~/.oci/config

[DEFAULT]
user=<user_ocid>
fingerprint=<new_key_fingerprint_from_console_or_list>
tenancy=<tenancy_ocid>
region=<region_identifier>
key_file=~/.oci/keys/new_api_key.pem

oci iam user api-key list --user-id <user_ocid> \
  --query 'data[].{"keyId":"key-id","fingerprint":"fingerprint"}' \
  --output table

oci iam compartment list --compartment-id <tenancy_ocid> --limit 1

oci iam user api-key list --user-id <user_ocid> \
  --query 'data[].{"keyId":"key-id","timeCreated":"time-created"}' \
  --output table

oci iam user api-key delete \
  --user-id <user_ocid> \
  --fingerprint <old_key_fingerprint> \
  --force

oci iam user api-key delete \
  --user-id <user_ocid> \
  --key-id <old_key_id> \
  --force

THRESHOLD_DAYS=90
CUTOFF_DATE=$(date -u -d "-${THRESHOLD_DAYS} days" +%s)

oci iam user api-key list --user-id <user_ocid> \
  --query 'data[].{"keyId":"key-id","timeCreated":"time-created"}' \
  --raw-output | jq -r '.[] | @base64' | while read row; do
  _jq() { echo ${row} | base64 --decode | jq -r ${1}; }
  KEY_ID=$(_jq '.keyId')
  TIME_CREATED=$(_jq '.timeCreated')
  CREATED_EPOCH=$(date -u -d "$TIME_CREATED" +%s)

  if [ "$CREATED_EPOCH" -lt "$CUTOFF_DATE" ]; then
    echo "API key $KEY_ID is older than ${THRESHOLD_DAYS} days."
    # Integrate here with OCI Notifications / email / Slack etc.
  fi
done

pip install oci

[DEFAULT]
user=ocid1.user.oc1..aaaa...
fingerprint=xx:xx:xx:...
key_file=/path/to/oci_api_key.pem
tenancy=ocid1.tenancy.oc1..aaaa...
region=us-ashburn-1

Allow group SecurityAdmins to inspect users in tenancy
Allow group SecurityAdmins to inspect api-keys in tenancy
Allow group SecurityAdmins to manage api-keys in tenancy  # only if you want auto-delete

import oci
from datetime import datetime, timezone, timedelta

# === CONFIG ===
PROFILE_NAME = "DEFAULT"             # profile from ~/.oci/config
MAX_AGE_DAYS = 90
AUTO_DELETE_OLD_KEYS = False         # set True if you want to auto-delete
DRY_RUN = True                       # if deleting, keep True to test first

def main():
    # Load config
    config = oci.config.from_file("~/.oci/config", PROFILE_NAME)
    identity_client = oci.identity.IdentityClient(config)

    tenancy_id = config["tenancy"]
    cutoff = datetime.now(timezone.utc) - timedelta(days=MAX_AGE_DAYS)

    print(f"Checking API keys older than {MAX_AGE_DAYS} days (before {cutoff.isoformat()})")

    # List all users in the tenancy
    users = oci.pagination.list_call_get_all_results(
        identity_client.list_users,
        compartment_id=tenancy_id
    ).data

    for user in users:
        user_ocid = user.id
        user_name = user.name

        # List API keys for each user
        api_keys = identity_client.list_api_keys(user_ocid).data

        for key in api_keys:
            key_id = key.key_id
            time_created = key.time_created  # datetime with timezone
            age_days = (datetime.now(timezone.utc) - time_created).days

            if time_created < cutoff:
                print(
                    f"[STALE] User: {user_name} ({user_ocid}), "
                    f"Key: {key_id}, Created: {time_created}, Age: {age_days} days"
                )

                if AUTO_DELETE_OLD_KEYS:
                    if DRY_RUN:
                        print(f"  -> DRY RUN: would delete key {key_id}")
                    else:
                        delete_api_key(identity_client, user_ocid, key_id)

            else:
                # Uncomment if you want to log all keys
                # print(f"[OK] User: {user_name}, Key: {key_id}, Age: {age_days} days")
                pass


def delete_api_key(identity_client, user_ocid, key_id):
    print(f"  -> Deleting key {key_id} for user {user_ocid}")
    identity_client.delete_api_key(
        user_id=user_ocid,
        fingerprint=key_id  # for API keys, key_id is the fingerprint
    )


if __name__ == "__main__":
    main()

0 1 * * * /usr/bin/python3 /path/to/check_oci_api_keys.py >> /var/log/oci_api_key_check.log 2>&1

# OCI IAM API keys cannot be rotated or time-limited via Terraform.
# The oci/oci provider does not expose a resource or argument that:
# - Sets an expiry/rotation interval for API keys, or
# - Rotates an existing API key on a schedule.

# API keys are created/managed as user credentials outside Terraform,
# so rotation every 90 days must be handled operationally:
#
# 1. In the OCI Console:
#    - Go to Identity & Security -> Users.
#    - Select the user -> API Keys.
#    - Add a new API key (download private key & config).
#    - Update any workloads using the old key to use the new key.
#    - Delete the old API key.
#
# 2. Or with OCI CLI or automation (scripts, CI pipelines, etc.)
#    to:
#    - Create new API keys,
#    - Update consuming apps’ configs,
#    - Delete keys older than 90 days.
#
# For “OCI IAM Monitoring”, Terraform can at most:
# - Tag users or keys (where supported) and you then monitor age externally,
# - Or wire up alarms/logging that detect keys older than 90 days.
# But the actual key rotation remains a runtime/manual process.

# Because Terraform cannot manage or rotate oci-identitymanagement-iam-apikey
# credentials directly, `terraform plan` will show **no changes** related to
# key rotation; all rotation behavior must be implemented outside Terraform.