Quick Answer

The correct IAM action is iam:UpdateAccessKey, as this is the specific permission required to change the status of an existing access key from active to inactive or vice versa, which is the core operation in rotating keys. While iam:CreateAccessKey generates a new key pair and iam:DeleteAccessKey removes an old one, the rotation process itself hinges on updating the key’s state to disable the old key after creating a new one, making UpdateAccessKey the essential action. On the AWS Certified Security Specialty SCS-C02 exam, this question tests your understanding of least-privilege permissions for self-service key management, often appearing as a distractor where candidates mistakenly choose CreateAccessKey because they focus on generating a new key rather than the update step that completes the rotation. A common trap is confusing the creation of a new key with the update that disables the old one—remember that rotation is a two-step process, but the action that controls the key’s lifecycle state is UpdateAccessKey. Memory tip: think of “Update” as the toggle switch that turns off the old key, making it the gatekeeper of rotation.