Automate monthly API key and secret rotation reminders

AWS describes access keys as long-term credentials and recommends short-lived alternatives where you can. In practice a team still holds some keys: a payment provider, a mail service, a deploy token. They get created once, pasted into a config, and forgotten. A key will not remind you of its own age. Without a date on a calendar, the key lives until it leaks or the person who created it leaves.

You keep a simple sheet with one row per key, shared as an upload. Example columns:

| Key name | System | Owner | Last rotated | Limit (days) | |---|---|---|---|---| | mail-service-prod | Mail | Dana | 2026-06-01 | 90 |

It holds names and dates. Never put secret values, key IDs or tokens in it; the agent stops and reports if a row looks like one. For AWS users, each key's metadata includes a creation date and a last-used lookup is available, so the sheet can be filled from there.

On the 1st of each month a scheduled agent reads the sheet and works out the age of every key from its created or rotated date. It lists keys past their limit, keys that will pass it in the next 30 days, and keys with no owner. It orders each list by age and names the owner to ask. It reads and reports. It does not create, rotate, disable or delete any key, and it has no access to your systems.

Before the reminder reaches you, the department head agent checks it: are the ages computed from the right date, is any key listed in two groups, and does any row look as if it contains a secret. Then you approve, edit or skip the reminder, and nothing is sent until you do. After you rotate a key, update its date in the sheet so it drops off the list next month.