Back to Checks
stackit

ObjectStorage access keys should have an expiration date

objectstorage_access_key_expiration
Service: objectstorageSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

ObjectStorage access keys should have an explicit expiration date. Long-lived credentials increase the blast radius of a credential compromise because they cannot expire on their own. Setting an expiration date enforces periodic rotation and limits the exposure window if a key is leaked.

Prowler logoProwlerprowler-provider-stackit

Risk

If an ObjectStorage access key is leaked, stolen, or forgotten without an expiration date, it remains usable indefinitely. An attacker can retain persistent access to object storage resources until the key is manually revoked.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler stackit --checks objectstorage_access_key_expiration

Recommendation

Create ObjectStorage access keys with an explicit expiration date and establish a rotation process. Delete non-expiring keys and replace them with time-limited credentials. A rotation period of 90 days or less is recommended.

Remediation

Other

1In the STACKIT Portal navigate to Object Storage > Access Keys. 2. Delete the non-expiring access key. 3. Create a new access key with an expiration date appropriate for your rotation policy (e.g. 90 days). 4. Update all applications and services that use the old key with the new credentials.

Check Code

from prowler.lib.check.models import Check, CheckReportStackIT
from prowler.providers.stackit.services.objectstorage.objectstorage_client import (
    objectstorage_client,
)


class objectstorage_access_key_expiration(Check):
    def execute(self):
        findings = []
        for key in objectstorage_client.access_keys:
            report = CheckReportStackIT(
                metadata=self.metadata(),
                resource=key,
            )
            report.resource_id = key.key_id
            report.resource_name = key.display_name
            report.location = key.region

            if key.has_expiration():
                report.status = "PASS"
                report.status_extended = f"Access key {key.display_name} has an expiration date set ({key.expires})."
            else:
                report.status = "FAIL"
                report.status_extended = f"Access key {key.display_name} has no expiration date and never rotates."

            findings.append(report)
        return findings

References