## TL;DR

The new key exists but some caller still uses the old one. Query CloudTrail for the old key's usage, update each caller, and only then deactivate the old key.

## Error

```text
aws key rotation failed: old key still in use
```

## Steps

1. Look up the old key's recent usage in CloudTrail by access key id. Expected: the list of callers still using it.
2. Update each caller to the new key: config files, env, CI secrets, third-party integrations. Expected: callers move one by one.
3. Watch CloudTrail until the old key goes quiet. Expected: zero usage confirms the cutover.
4. Deactivate (do not delete) the old key and wait through a full cycle. Expected: any missed caller surfaces as an error, not an outage.
5. Delete the old key after the quiet period. Expected: rotation complete.

## When to use

- Rotations that cannot finish because of lingering old-key use.
- Auditing who uses a key before deleting it.

## When not to use

- The new key was never created (fix creation first).
- The new key does not work (fix the new key, not the old).

## Tool compatibility

- AWS IAM access keys; CloudTrail for usage lookup.

## Variant phrasings

### old aws key still active after rotation

Same straggler hunt.

### cannot deactivate old access key

Find users first.

## Why it happens

Keys get copied into places outside the rotation's reach: vendor dashboards, old scripts, baked images. The rotation only knows about the key, not its copies.

## Edge cases

- Third-party services rotate on their own schedule; coordinate with them.
- Deleting before deactivating skips the safety net; always deactivate first.
- CloudTrail has a delay; wait before declaring the key quiet.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_kEA4XpLGJUdSJuFFAA9PGw