> ## Documentation Index
> Fetch the complete documentation index at: https://help.dsalta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Service account keys should be rotated within 90 days

> Checks that Nebius service account keys/tokens are rotated within the configured window.

Checks that Nebius service account keys/tokens are rotated within the configured window.

## About

When you connect Nebius to DSALTA, the platform reads your service account keys using read-only IAM access and flags any key older than the configured rotation threshold (90 days by default). DSALTA evaluates this control on every sync.

## Why This Matters

Long-lived credentials increase the blast radius of a leaked key — the older a key is, the more time an attacker has to find and abuse it. Regular key rotation is expected by frameworks including SOC 2, ISO 27001:2022, NIST CSF, and CIS.

## How to Fix

**Before you begin**

* Review the service account keys flagged as past the rotation window in the DSALTA check details.
* Ensure you have **tenant admin** rights in the Nebius Console.

**Rotate keys**

1. In the **Nebius Console**, go to **IAM → Service accounts**.
2. Open the affected service account and go to its **keys**.
3. Create a new key and update any system that uses the old one.
4. Delete the old key once the new key is in use.

Once all service account keys are younger than the configured rotation window, DSALTA retrieves the change on the next sync and sets the check status to **Passing**.

## Frequently Asked Questions

<AccordionGroup>
  <Accordion title="How often does this check run?">
    This check runs automatically every 24 hours while the Nebius integration is connected. You can also trigger a manual sync from **Integrations** in the sidebar.
  </Accordion>

  <Accordion title="What happens if it keeps failing?">
    A failing check appears in your **Data Library → Tests** dashboard. Work through the steps above; once the underlying configuration is fixed, the status updates automatically on the next sync.
  </Accordion>

  <Accordion title="Can I exclude this check?">
    Yes. If it does not apply to your environment, mark it as **Not Applicable** with a justification. The exclusion is documented for auditors.
  </Accordion>

  <Accordion title="Does DSALTA change my Nebius configuration?">
    No. DSALTA uses **read-only IAM access** and never modifies, creates, or deletes resources. All remediation is performed by your team directly in Nebius.
  </Accordion>
</AccordionGroup>