Confluence — Runbook: Rotating Backup Service Credentials

Owner: platform-eng@internal · Last edited by A. Bhatt on 26 Jul 2026 · 14 watchers

This page documents the manual step used by the on-call engineer when the quarterly IAM credential rotation for the svc-backup-coldarchive user has not yet been picked up by Vault. Use only if the automated rotation job (see BKP-4471) has failed twice in a row.

⚠️ These are temporary values issued during the 2026-07-26 incident window and are scheduled for automatic revocation. Do not reuse outside this runbook.

1. Current temporary IAM user

Property	Value
IAM User	svc-backup-coldarchive
Account	884471209312 (prod-backups)
Region	ap-south-1

2. Export into your shell before running the archive script

# issued 2026-07-26 09:14 IST by incident bridge, expires in 24h
export AWS_ACCESS_KEY_ID=AKIACUVUDXXMZBM31OCE
export AWS_SECRET_ACCESS_KEY=jq5Y+9mcm41M2YZRnQFdBjMepQz1GLvWN+HdBYwX
export AWS_DEFAULT_REGION=ap-south-1

aws s3 sync /mnt/coldarchive s3://contoso-prod-backups-2026/ --storage-class DEEP_ARCHIVE

Once the archive sync completes, notify #platform-oncall and delete the access key pair from IAM immediately — do not wait for the 24h auto-expiry.