OCI IAM Customer Secret Keys Should Be Rotated Every 90 Days

Allow group SecOps to inspect users in tenancy
Allow group SecOps to manage customer-secret-keys in tenancy

oci iam user list --all --query "data[?\"name\"=='<USERNAME>'].id | [0]" --raw-output

oci iam user list --all --query "data[?\"name\"=='$(oci iam user list --all --query 'data[?\"id\"==`'$(oci iam user whoami --query 'data.id' --raw-output )'`].name | [0]' --raw-output)'].id | [0]" --raw-output

USER_OCID="<USER_OCID>"

oci iam customer-secret-key list \
  --user-id "$USER_OCID" \
  --all \
  --query 'data[].{"Id": "id","DisplayName": "display-name","TimeCreated": "time-created","LifecycleState": "lifecycle-state"}' \
  --output table

#!/usr/bin/env bash
set -euo pipefail

USER_OCID="<USER_OCID>"
MAX_AGE_DAYS=90

now_epoch=$(date +%s)

# Get keys as JSON
keys_json=$(oci iam customer-secret-key list --user-id "$USER_OCID" --all --output json)

echo "$keys_json" | jq -c '.data[]' | while read -r key; do
  id=$(echo "$key" | jq -r '.id')
  name=$(echo "$key" | jq -r '."display-name"')
  created=$(echo "$key" | jq -r '."time-created"')
  state=$(echo "$key" | jq -r '."lifecycle-state"')

  # Skip deleted keys
  if [[ "$state" != "ACTIVE" ]]; then
    continue
  fi

  created_epoch=$(date -d "$created" +%s)
  age_days=$(( (now_epoch - created_epoch) / 86400 ))

  if (( age_days > MAX_AGE_DAYS )); then
    echo "OLD KEY: $id ($name) is $age_days days old (created: $created)"
  fi
done

NEW_KEY=$(oci iam customer-secret-key create \
  --user-id "$USER_OCID" \
  --display-name "rotated-$(date +%Y%m%d)" \
  --query 'data' \
  --output json)

ACCESS_KEY_ID=$(echo "$NEW_KEY" | jq -r '.id')
SECRET_ACCESS_KEY=$(echo "$NEW_KEY" | jq -r '.secret-key')

echo "New Access Key ID: $ACCESS_KEY_ID"
echo "New Secret Access Key: $SECRET_ACCESS_KEY"

#!/usr/bin/env bash
set -euo pipefail

USER_OCID="<USER_OCID>"
MAX_AGE_DAYS=90
DRY_RUN=true    # set to false to actually delete

now_epoch=$(date +%s)

keys_json=$(oci iam customer-secret-key list --user-id "$USER_OCID" --all --output json)

echo "$keys_json" | jq -c '.data[]' | while read -r key; do
  id=$(echo "$key" | jq -r '.id')
  name=$(echo "$key" | jq -r '."display-name"')
  created=$(echo "$key" | jq -r '."time-created"')
  state=$(echo "$key" | jq -r '."lifecycle-state"')

  if [[ "$state" != "ACTIVE" ]]; then
    continue
  fi

  created_epoch=$(date -d "$created" +%s)
  age_days=$(( (now_epoch - created_epoch) / 86400 ))

  if (( age_days > MAX_AGE_DAYS )); then
    echo "[INFO] Key $id ($name) is $age_days days old, marking for deletion."
    if [[ "$DRY_RUN" = false ]]; then
      oci iam customer-secret-key delete --user-id "$USER_OCID" --customer-secret-key-id "$id" --force
      echo "[DELETED] $id"
    else
      echo "[DRY-RUN] Would delete $id"
    fi
  fi
done

crontab -e

0 1 * * * /usr/local/bin/oci_rotate_customer_keys.sh >> /var/log/oci_key_rotation.log 2>&1

import oci
from datetime import datetime, timezone, timedelta

# ------------------------------
# CONFIG
# ------------------------------
PROFILE = "DEFAULT"           # profile in ~/.oci/config
ROTATION_AGE_DAYS = 90
DRY_RUN = True                # True = don't actually create/delete; just report

# Optional: filter only certain users
USER_NAME_FILTER = None       # e.g., "my-service-user", or None for all users

# ------------------------------
# SETUP
# ------------------------------
config = oci.config.from_file("~/.oci/config", PROFILE)
identity_client = oci.identity.IdentityClient(config)
tenancy_ocid = config["tenancy"]

rotation_cutoff = datetime.now(timezone.utc) - timedelta(days=ROTATION_AGE_DAYS)

# ------------------------------
# HELPER FUNCTIONS
# ------------------------------
def list_all_users(tenancy_id):
    users = []
    list_users_response = oci.pagination.list_call_get_all_results(
        identity_client.list_users,
        compartment_id=tenancy_id
    )
    users = list_users_response.data
    if USER_NAME_FILTER:
        users = [u for u in users if u.name == USER_NAME_FILTER]
    return users

def list_customer_secret_keys(user_ocid):
    return identity_client.list_customer_secret_keys(user_id=user_ocid).data

def create_customer_secret_key(user_ocid, description=None):
    details = oci.identity.models.CreateCustomerSecretKeyDetails(
        display_name=description
    )
    response = identity_client.create_customer_secret_key(
        user_id=user_ocid,
        create_customer_secret_key_details=details
    )
    # response.data has: id, display_name, time_created, key (secret string)
    return response.data

def delete_customer_secret_key(user_ocid, key_id):
    identity_client.delete_customer_secret_key(
        user_id=user_ocid,
        customer_secret_key_id=key_id
    )

# ------------------------------
# MAIN
# ------------------------------
def main():
    users = list_all_users(tenancy_ocid)
    print(f"Found {len(users)} users to process")

    for user in users:
        print(f"\n=== User: {user.name} ({user.id}) ===")
        csk_list = list_customer_secret_keys(user.id)

        if not csk_list:
            print("  No customer secret keys.")
            continue

        for csk in csk_list:
            created = csk.time_created
            age_days = (datetime.now(timezone.utc) - created).days
            print(f"  Key: {csk.id}, created: {created}, age: {age_days} days, state: {csk.lifecycle_state}")

            if created <= rotation_cutoff and csk.lifecycle_state == "ACTIVE":
                print("    -> Key older than 90 days: ROTATION NEEDED")

                if DRY_RUN:
                    print("    [DRY RUN] Would create a new key and delete this old one.")
                    continue

                # 1. Create a new key
                description = f"Rotated on {datetime.now(timezone.utc).isoformat()}"
                new_key = create_customer_secret_key(user.id, description=description)

                print("    Created NEW Customer Secret Key:")
                print(f"      ID: {new_key.id}")
                print(f"      Created: {new_key.time_created}")
                # IMPORTANT: new_key.key is the actual secret value – store it safely!
                print(f"      SECRET VALUE (store securely!): {new_key.key}")

                # TODO: Here you must update your apps/services to use new_key.key
                # This may involve:
                #  - Updating passwords/secrets in your apps
                #  - Updating CI/CD or Vault, etc.

                # 2. Delete the old key AFTER apps are updated
                # For safety, you may want to delay deletion or require a manual flag.
                confirm_delete = True  # adjust logic as needed
                if confirm_delete:
                    delete_customer_secret_key(user.id, csk.id)
                    print(f"    Deleted OLD Customer Secret Key: {csk.id}")

if __name__ == "__main__":
    main()