AWS

Connect an AWS account to Expira with a read-only IAM user to track ACM, Private CA, RDS, IAM, SAML, Secrets Manager, KMS and Route 53 expiry.

Expira scans an AWS account and tracks everything in it that expires or needs rotating. It only calls list and describe APIs. It never reads a secret’s value, only its rotation metadata.

What Expira finds

Each type can be turned on or off per connection.

Certificates and PKI

Type	Default	Notes
ACM certificates	On	Public and private certificates. Imported ones are flagged because they never auto-renew.
ACM Private CA	On	CA certificate expiry. Everything the CA issued stops working with it.
IAM server certificates	On	Legacy uploads for classic ELB and CloudFront.
RDS / Aurora CA certificates	On	Per-instance CA validity. Rotation needs a reboot.
Directory Service LDAPS	Off	Certificates registered on Managed Microsoft AD.

Credentials and secrets

Type	Default	Notes
IAM access key rotation	On	Access keys never expire in AWS. Expira tracks a rotation deadline: creation date + Rotate after (default 90 days).
IAM console passwords	On	Only when the account password policy sets a maximum age.
SAML identity providers	On	Metadata validity. Every federated login breaks when it lapses.
Secrets Manager rotation	On	The next scheduled rotation, for secrets that rotate.
Unrotated secrets	Off	Secrets with no rotation set up, flagged after Flag stale after days (default 180).
KMS keys pending deletion	On	Deletion makes everything the key encrypted unrecoverable.

Domains

Type	Default	Notes
Route 53 registered domains	On	Registration expiry and auto-renew status.

Connect an account

1. Create a dedicated IAM user

   In the AWS console, go to IAM → Users → Create user. Don’t give it console access; Expira only needs an access key.

2. Attach the read-only policy

   Attach this policy to the user, as an inline policy or a customer-managed one. The same policy is in the connection form, with a Copy button.

   Expira read-only policy

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "ExpiraReadOnlyDiscovery",
         "Effect": "Allow",
         "Action": [
           "sts:GetCallerIdentity",
           "ec2:DescribeRegions",
           "iam:ListAccountAliases",
           "acm:ListCertificates",
           "acm-pca:ListCertificateAuthorities",
           "iam:ListServerCertificates",
           "rds:DescribeDBInstances",
           "ds:DescribeDirectories",
           "ds:ListCertificates",
           "iam:ListUsers",
           "iam:ListAccessKeys",
           "iam:GenerateCredentialReport",
           "iam:GetCredentialReport",
           "iam:ListSAMLProviders",
           "secretsmanager:ListSecrets",
           "kms:ListKeys",
           "kms:ListAliases",
           "kms:DescribeKey",
           "route53domains:ListDomains"
         ],
         "Resource": "*"
       }
     ]
   }
   

   If you leave out actions for a service, those types show as Skipped after a sync instead of failing. See Skipped types.

3. Create an access key

   Open the user, go to Security credentials → Create access key, and copy the access key ID and secret access key.

4. Add the connection in Expira

   Go to Integrations → AWS → Add connection and fill in:

   • Display name, for example “Production account”.
   • Access key ID (starts with AKIA).
   • Secret access key.
   • Regions (optional): a comma-separated list such as eu-west-1, us-east-1. Leave it blank to scan every enabled region. IAM and Route 53 are global and always scanned.
   • The types to discover, and the rotation and staleness ages.

   Save, then press Sync to scan now instead of waiting for the daily run at 07:30 UTC.

Restricting regions makes each sync faster. Connect each AWS account separately: every account is one integration connection.

Skipped types

AWS returns AccessDenied when the policy doesn’t allow a service. Expira treats this as normal and lists those types under the sync result: “Skipped (the IAM policy does not allow it): …”. Add the missing actions to the policy to scan them.

Wrong credentials are different: a mistyped or revoked key fails the whole sync, so a bad key is never reported as a clean run.

Rotate or revoke the key

To rotate, create a new access key, paste it into the connection’s Edit form, and delete the old key in AWS. To disconnect, remove the integration, then delete the IAM user.

With IAM access key rotation turned on, Expira also tracks the rotation deadline of the key it uses itself, so you’ll be reminded when it’s due.