Expired Access Keys Are Now Revoked Automatically
A key with an expiry date is now revoked within five minutes after that date, so a temporary key stops working when you meant it to.
What's changed
- Set an expiry date when you create a key through the API, the danube CLI (--expires) or Terraform; the console form has no expiry field
- Within five minutes after that date the key is revoked, whichever kind of key it is, and from then on it rejects every request, including access a bucket policy gave it
- Until now the date was only recorded: an expired key for all buckets, or one named in a bucket policy, kept working until it was revoked by hand
- Statements in a bucket policy that name the key stay in place and grant nothing; the policy editor marks them as revoked