Yes. Writing code is use-case specific. You can start writing it yourself and then ask again if you have any specific issue.

But generally, to implement periodic rotation you would use:

• CloudWatch Event scheduled rules

The rule would automatically call a target, i.e. your lambda function, which would have logic to perform the rotation. For that boto3's create_access_key_pair along with deleting/disable existing keys (delete_access_key or update_access_key to disable).

Yes this is definitely possible, the AWS SDK has a action for list_access_keys.

If you created a CloudWatch event you could trigger this Lambda every day. Once you call the request you can see all access keys with a UserName value and a CreateDate value.

By doing a comparison between the 2 dates you could then perform the requested action.

• Using either SES or SNS notify the user at 85 days
• Use the create_access_key method at 90 days
• Use the delete_access_key at 95 days.