Skip to main content
Expira scans an AWS account and tracks everything in it that expires or needs rotating. It only calls list and describe APIs. It never reads a secret’s value, only its rotation metadata.

​
What Expira finds

Each type can be turned on or off per connection. Certificates and PKI Credentials and secrets Domains

​
Connect an account

1

Create a dedicated IAM user

In the AWS console, go to IAM → Users → Create user. Don’t give it console access; Expira only needs an access key.
2

Attach the read-only policy

Attach this policy to the user, as an inline policy or a customer-managed one. The same policy is in the connection form, with a Copy button.
Expira read-only policy
If you leave out actions for a service, those types show as Skipped after a sync instead of failing. See Skipped types.
3

Create an access key

Open the user, go to Security credentials → Create access key, and copy the access key ID and secret access key.
4

Add the connection in Expira

Go to Integrations → AWS → Add connection and fill in:
  • Display name, for example “Production account”.
  • Access key ID (starts with AKIA).
  • Secret access key.
  • Regions (optional): a comma-separated list such as eu-west-1, us-east-1. Leave it blank to scan every enabled region. IAM and Route 53 are global and always scanned.
  • The types to discover, and the rotation and staleness ages.
Save, then press Sync to scan now instead of waiting for the daily run at 07:30 UTC.
Restricting regions makes each sync faster. Connect each AWS account separately: every account is one integration connection.

​
Skipped types

AWS returns AccessDenied when the policy doesn’t allow a service. Expira treats this as normal and lists those types under the sync result: “Skipped (the IAM policy does not allow it): …”. Add the missing actions to the policy to scan them. Wrong credentials are different: a mistyped or revoked key fails the whole sync, so a bad key is never reported as a clean run.

​
Rotate or revoke the key

To rotate, create a new access key, paste it into the connection’s Edit form, and delete the old key in AWS. To disconnect, remove the integration, then delete the IAM user. With IAM access key rotation turned on, Expira also tracks the rotation deadline of the key it uses itself, so you’ll be reminded when it’s due.