An AWS Access Key Can Outlive the Workload That Needed It

An AWS IAM user access key does not expire because nobody uses it anymore.

It remains valid until someone explicitly deactivates or deletes it.

That creates a surprisingly common lifecycle failure. The workload disappears, the migration finishes, the CI pipeline is replaced, or the original owner moves on. The credential survives.

It is still a valid authentication path.

And if that credential leaks, automated discovery can turn exposure into active abuse within minutes.