Issue a replacement key pair for the same PD AWS S3 service without moving its buckets or data. Rotation retires the previous service key, so coordinate all applications that depend on it.

Prepare dependent tools

Identify backup jobs, storage clients and applications using the service. Keep access to their private credential settings ready and choose a suitable change window. This action replaces the customer service credential, not the host’s AWS provisioning credential.

Rotate and reconnect

1. Open the intended service’s Connection details in the client area.
2. Use the available credential-rotation control and review its confirmation.
3. Save the new access key and secret in the intended private application settings.
4. Update every dependent tool.
5. Verify a controlled operation against the same bucket and region.

Staff can also use PD AWS S3 → Clients & Storage → Rotate keys for the intended service. Review the exact service before confirming.

The previous key stops working after rotation. Existing presigned links signed with it can stop working too; do not promise they remain valid until their displayed expiry. Reissue required links after the new credentials work.

Investigate an uncertain result

Inspect the current Connection details and Activity before rotating again. A failed request can occur after a provider-side change, so repeated rotation is not the first diagnostic step.

Keep access key secrets out of support attachments. If applications still fail, compare endpoint, service mode and the complete current credential pair using the connection guide.

See the PD AWS S3 Blesta guide for related tasks, or explore the module.