diff --git a/AWS-IAM-CLI.md b/AWS-IAM-CLI.md
index c247d57..b3db080 100644
--- a/AWS-IAM-CLI.md
+++ b/AWS-IAM-CLI.md
@@ -87,6 +87,18 @@ aws --endpoint $AWS_ENDPOINT iam get-user --user-name bob
 aws --endpoint $AWS_ENDPOINT iam delete-user --user-name bob
 ```
 
+### Enable/Disable User
+
+Disable or re-enable a user without deleting them:
+
+```bash
+# Disable a user (all their access keys will stop working)
+aws --endpoint $AWS_ENDPOINT iam set-user-status --user-name bob --status Inactive
+
+# Re-enable the user
+aws --endpoint $AWS_ENDPOINT iam set-user-status --user-name bob --status Active
+```
+
 ---
 
 ## Access Key Management
@@ -134,6 +146,24 @@ Output:
 aws --endpoint $AWS_ENDPOINT iam delete-access-key --user-name bob --access-key-id X8R439UM7OSQJX28I9QTP
 ```
 
+### Update Access Key Status
+
+Deactivate or reactivate an access key without deleting it:
+
+```bash
+# Deactivate an access key
+aws --endpoint $AWS_ENDPOINT iam update-access-key \
+  --user-name bob \
+  --access-key-id X8R439UM7OSQJX28I9QTP \
+  --status Inactive
+
+# Reactivate the access key
+aws --endpoint $AWS_ENDPOINT iam update-access-key \
+  --user-name bob \
+  --access-key-id X8R439UM7OSQJX28I9QTP \
+  --status Active
+```
+
 ### Self-Service: Manage Your Own Keys
 
 Users can manage their own access keys without admin privileges:
diff --git a/Amazon-IAM-API.md b/Amazon-IAM-API.md
index 0b0c173..e88b70d 100644
--- a/Amazon-IAM-API.md
+++ b/Amazon-IAM-API.md
@@ -55,8 +55,10 @@ weed iam -filer=localhost:8888 -port=8111
 | `GetUser` | Get user details | Yes (own user) |
 | `UpdateUser` | Update user properties | Admin only |
 | `ListUsers` | List all users | Admin only |
+| `SetUserStatus` | Enable or disable a user | Admin only |
 | `CreateAccessKey` | Create access key for user | Yes (own keys) |
 | `DeleteAccessKey` | Delete access key | Yes (own keys) |
+| `UpdateAccessKey` | Change access key status (Active/Inactive) | Yes (own keys) |
 | `ListAccessKeys` | List access keys for user | Yes (own keys) |
 | `CreatePolicy` | Validate a policy document | Admin only |
 | `PutUserPolicy` | Attach inline policy to user | Admin only |
@@ -156,6 +158,71 @@ aws --endpoint $AWS_ENDPOINT iam create-access-key
 
 # List own access keys
 aws --endpoint $AWS_ENDPOINT iam list-access-keys
+
+# Deactivate an access key (key rotation)
+aws --endpoint $AWS_ENDPOINT iam update-access-key --access-key-id AKIAEXAMPLE --status Inactive
+```
+
+---
+
+## User and Access Key Status Management
+
+SeaweedFS supports enabling/disabling users and access keys without deleting them. This is useful for:
+
+- **Temporary suspension**: Disable user access during investigation
+- **Key rotation**: Deactivate old keys before deletion  
+- **Offboarding**: Disable rather than delete for audit purposes
+- **Emergency response**: Quickly disable compromised credentials
+
+### Disable a User
+
+```bash
+# Disable a user (all their access keys will stop working)
+aws --endpoint $AWS_ENDPOINT iam set-user-status --user-name alice --status Inactive
+
+# Re-enable the user
+aws --endpoint $AWS_ENDPOINT iam set-user-status --user-name alice --status Active
+```
+
+### Deactivate an Access Key
+
+```bash
+# Deactivate an access key
+aws --endpoint $AWS_ENDPOINT iam update-access-key \
+  --user-name alice \
+  --access-key-id AKIAEXAMPLE \
+  --status Inactive
+
+# Reactivate the access key
+aws --endpoint $AWS_ENDPOINT iam update-access-key \
+  --user-name alice \
+  --access-key-id AKIAEXAMPLE \
+  --status Active
+```
+
+### Check Access Key Status
+
+```bash
+# List access keys shows their status
+aws --endpoint $AWS_ENDPOINT iam list-access-keys --user-name alice
+```
+
+Output:
+```json
+{
+    "AccessKeyMetadata": [
+        {
+            "UserName": "alice",
+            "AccessKeyId": "X8R439UM7OSQJX28I9QTP",
+            "Status": "Active"
+        },
+        {
+            "UserName": "alice", 
+            "AccessKeyId": "Y9S540VN8PTRKZ39J0URP",
+            "Status": "Inactive"
+        }
+    ]
+}
 ```
 
 ---