How should I implement key rotation for my AWS credentials in prod environment?

Question

I'm looking at the below link which explains how to use AWS API to send emails. How would the below example work in prod environment since AWS access key ID and AWS secret access key added to the credential file would expire after some time.

https://docs.aws.amazon.com/ses/latest/DeveloperGuide/send-using-sdk-java.html

I can see how AWS SES SMTP can be used to send emails since the credentials don't change can be saved in a file on a server but unsure how SES API in the above link can be used.

Answer 1

Store your AWS credentials in Secrets Manager and automate the key rotation using SNS + Lambda, from there you could send the newly updated keys to your application through an endpoint.

Use this guide from the AWS Documentation as a somewhat relevant source of what you're trying to accomplish: https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/automatically-rotate-iam-user-access-keys.html