handle expiring / expired keys, test getting keys from IAM