Active access keys are rotated at least every 90 days.

Risk if it fails

Stale keys that linger are more likely to be leaked and reused.

Old keys often end up in code, laptops and chat logs. An attacker who finds a years-old key can still use it because it was never retired.