aws key rotation failed: old key still in use

TL;DR

The new key exists but some caller still uses the old one. Query CloudTrail for the old key's usage, update each caller, and only then deactivate the old key.

Error

aws key rotation failed: old key still in use

Steps

1. Look up the old key's recent usage in CloudTrail by access key id. Expected: the list of callers still using it.
2. Update each caller to the new key: config files, env, CI secrets, third-party integrations. Expected: callers move one by one.
3. Watch CloudTrail until the old key goes quiet. Expected: zero usage confirms the cutover.
4. Deactivate (do not delete) the old key and wait through a full cycle. Expected: any missed caller surfaces as an error, not an outage.
5. Delete the old key after the quiet period. Expected: rotation complete.

When to use

• Rotations that cannot finish because of lingering old-key use.
• Auditing who uses a key before deleting it.

When not to use

• The new key was never created (fix creation first).
• The new key does not work (fix the new key, not the old).

Tool compatibility

• AWS IAM access keys; CloudTrail for usage lookup.

Variant phrasings

old aws key still active after rotation

Same straggler hunt.

cannot deactivate old access key

Find users first.

Why it happens

Keys get copied into places outside the rotation's reach: vendor dashboards, old scripts, baked images. The rotation only knows about the key, not its copies.

Edge cases

• Third-party services rotate on their own schedule; coordinate with them.
• Deleting before deactivating skips the safety net; always deactivate first.
• CloudTrail has a delay; wait before declaring the key quiet.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_kEA4XpLGJUdSJuFFAA9PGw