AWSAWS Identity and Access ManagementSecurity & Identity

`aws_iam_access_key` cost estimation

A long-lived access key ID and secret for an IAM user. Access keys are free to create and use, but a leaked key is one of the most expensive incidents in AWS, capable of running up tens of thousands of dollars in hours.

The aws_iam_access_key resource creates a long-lived credential pair (an access key ID and a secret access key) tied to an IAM user. Programs use it to sign AWS API requests. Like the rest of IAM, creating and using access keys is completely free, there is no per-key charge and no charge for the API calls the key authenticates at the IAM layer.

The reason this resource matters for cost is risk, not price. A leaked access key is one of the classic ways to generate a catastrophic AWS bill. Because the key carries the full permissions of its IAM user, an attacker who finds one committed to a public repository, embedded in a mobile app, or leaked in logs can launch large GPU instances for crypto mining, spin up thousands of resources, or exfiltrate data across regions and rack up data transfer charges. Real incidents have produced bills from thousands to hundreds of thousands of dollars before AWS abuse detection or the account owner noticed.

The safer pattern is to avoid long-lived access keys almost entirely. For workloads running on AWS compute, use IAM roles (aws_iam_role) with instance profiles, ECS task roles, or IRSA for EKS, which issue short-lived temporary credentials automatically. For human and CI access, use IAM Identity Center or GitHub OIDC federation so no static secret ever exists. Access keys are appropriate mainly for on-premises systems and third-party tools that genuinely cannot assume a role.

When you must use them, put the secret in a secure store rather than plain Terraform state. Note that aws_iam_access_key writes the secret into Terraform state in cleartext, so the state backend must be encrypted and access-controlled. Common practice is to feed the key into aws_secretsmanager_secret or aws_ssm_parameter, both of which have their own small charges (Secrets Manager is 0.40 dollars per secret per month plus API calls, SSM SecureString standard tier is free).

c3x reports aws_iam_access_key as a free resource, but flag it in review: the cost exposure is the blast radius of the credential, not a line item.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_iam_user" "ci" {
  name = "ci-deploy"
}

resource "aws_iam_access_key" "ci" {
  user = aws_iam_user.ci.name
}

# Store the secret rather than printing it. State still holds it in cleartext,
# so keep the state backend encrypted and access-controlled.
resource "aws_secretsmanager_secret" "ci_key" {
  name = "ci-deploy-access-key"
}

resource "aws_secretsmanager_secret_version" "ci_key" {
  secret_id = aws_secretsmanager_secret.ci_key.id
  secret_string = jsonencode({
    access_key_id     = aws_iam_access_key.ci.id
    secret_access_key = aws_iam_access_key.ci.secret
  })
}

Pricing dimensions

What you actually pay for when you provision aws_iam_access_key.

Dimension	Unit	What's being charged
IAM access key	free	Creating and using access keys is free. There is no per-key charge and IAM authorization is not billed. $0 (free)
Secrets Manager storage (if used)	per secret per month	Storing the key in Secrets Manager for safe distribution adds a per-secret monthly fee plus API calls. $0.40 per secret per month + $0.05 per 10,000 API calls
Leaked-key blast radius	variable	Not an AWS line item but the real financial exposure. A compromised key can launch GPU fleets and data transfer that bill thousands of dollars per day until caught. $0 to tens of thousands (incident-driven)

Optimization tips

Common ways to reduce aws_iam_access_key cost without changing the workload.

Replace access keys with IAM roles wherever possible

Avoids the single largest source of surprise AWS bills

Workloads on EC2, ECS, Lambda, and EKS should use IAM roles that issue short-lived temporary credentials. Roles remove the static secret entirely and eliminate the leaked-key risk. Reserve access keys for on-premises or third-party tools that cannot assume a role.

Use OIDC federation for CI/CD instead of stored keys

GitHub Actions, GitLab, and other CI systems can assume an AWS role via OIDC, so no long-lived key is stored in the pipeline. This is both free and far safer than an aws_iam_access_key checked into a secret store.

Rotate and scope keys that must exist

If a key is unavoidable, rotate it on a schedule, attach a least-privilege policy, and add condition keys that restrict region and instance type so a leak cannot launch expensive resources.

Set a budget alarm and enable GuardDuty

A billing alarm and GuardDuty anomaly detection are the fastest way to catch a leaked key before the bill grows. GuardDuty is paid but cheap relative to a full incident; a basic AWS Budgets alert is free.

FAQ

Do IAM access keys cost anything?

No. Creating and using access keys is free, and the API calls they sign are not billed at the IAM layer. The financial risk is entirely about what happens if the key leaks, which is why teams minimize their use.

Why are leaked access keys so expensive?

A long-lived key carries the full permissions of its IAM user and never expires until rotated or deleted. Attackers scan public repositories and leaked logs for keys and immediately launch large GPU instances for crypto mining. Bills of tens of thousands of dollars within a day are documented.

What is the alternative to access keys?

IAM roles with temporary credentials. Use instance profiles for EC2, task roles for ECS, execution roles for Lambda, IRSA for EKS, and OIDC federation for CI. All are free and remove the static secret entirely.

Is the secret stored in Terraform state?

Yes. aws_iam_access_key writes the secret access key into Terraform state in cleartext. Keep the state backend encrypted and locked down, and treat anyone with state access as holding the credential.