New keys for a sub-user

A sub-user gets one key pair in each of its regions automatically — when you create it and when you add a region. By default it can have only one key per region, so you rarely create sub-user keys by hand.

You manage sub-user keys on the Access Keys page, under the Sub-user Keys tab. The buttons work the same way as for your own keys — see Manage your keys.

A key was lost or leaked

Rotate it. On the Access Keys page, find the sub-user’s key and select Rotate Key. The old key stops working at once, and a file with the new access key and secret key downloads. Give the new key to the person or app that uses it.

To block a key for a while instead, select Deactivate Key. Select Activate Key to turn it back on.

Create a new key

You only need this after you deleted the sub-user’s key in a region.

This only works when the sub-user is in that region, has no key there yet, and is not suspended. You cannot delete a sub-user’s last key — delete the sub-user instead.

What the sub-user can do itself

A sub-user with dashboard access can see and rotate its own keys on its Access Keys page. You get a notification when it does. It cannot create, deactivate or delete keys. See What sub-users see: Access keys.