Skip to main content

๐Ÿ›ก๏ธ AWS IAM Access Key is unused๐ŸŸข

Logicโ€‹

Similar Policiesโ€‹

Descriptionโ€‹

Open File

Descriptionโ€‹

Identify and remove unused IAM access keys to protect AWS resources from unauthorized access. An IAM user access key pair is considered unused if it has not been used for a specified period, in this case, 90 days.

Rationaleโ€‹

IAM access keys provide programmatic access to AWS resources. Retaining active keys that are no longer in use increases the risk that lost or compromised credentials could be exploited. By evaluating access keys directly (rather than IAM users), security teams can precisely identify which credentials require revocation.

Auditโ€‹

This policy flags an AWS IAM Access Key as INCOMPLIANT if the Last Used Date field is empty or the date is more than 90 days ago.

Inactive Access Keys are marked as INAPPLICABLE.

Remediationโ€‹

Open File

Remediationโ€‹

Decommission Unused IAM Access Keysโ€‹

Deactivate any unnecessary or unused IAM access keys to reduce the risk of unauthorized access.

From Command Lineโ€‹

Run the update-access-key command to deactivate an unused or non-operational IAM access key:

aws iam update-access-key \
    --access-key-id {{access-key-id}} \
    --status Inactive

After deactivation, verify that the key is no longer required by any applications or services. Once confirmed, consider deleting the access key to permanently remove it:

aws iam delete-access-key \
    --access-key-id {{access-key-id}}

policy.yamlโ€‹

Open File

Linked Framework Sectionsโ€‹

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
๐Ÿ’ผ AWS Foundational Security Best Practices v1.0.0 โ†’ ๐Ÿ’ผ [IAM.8] Unused IAM user credentials should be removed2no data
๐Ÿ’ผ Cloudaware Framework โ†’ ๐Ÿ’ผ Credential Lifecycle Management32no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-2 Account Management (L)(M)(H)10859no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-2(1) Automated System Account Management (M)(H)32no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-2(3) Disable Accounts (M)(H)6no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-3 Access Enforcement (L)(M)(H)3790no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-6 Least Privilege (M)(H)81285no data
๐Ÿ’ผ FedRAMP Low Security Controls โ†’ ๐Ÿ’ผ AC-2 Account Management (L)(M)(H)9no data
๐Ÿ’ผ FedRAMP Low Security Controls โ†’ ๐Ÿ’ผ AC-3 Access Enforcement (L)(M)(H)90no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-2 Account Management (L)(M)(H)959no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-2(1) Automated System Account Management (M)(H)32no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-2(3) Disable Accounts (M)(H)6no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-3 Access Enforcement (L)(M)(H)90no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-6 Least Privilege (M)(H)685no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ DE.CM-01: Networks and network services are monitored to find potentially adverse events185no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events105no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization47no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties144no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected197no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.IR-01: Networks and environments are protected from unauthorized logical access and usage129no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-2 Account Management132158no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-2(1) Account Management _ Automated System Account Management432no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-2(3) Account Management _ Disable Accounts16no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-3 Access Enforcement15666no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-3(7) Access Enforcement _ Role-based Access Control36no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-3(15) Access Enforcement _ Discretionary and Mandatory Access Control27no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-6 Least Privilege102378no data
๐Ÿ’ผ PCI DSS v3.2.1 โ†’ ๐Ÿ’ผ 8.1.4 Remove/disable inactive user accounts within 90 days.2no data
๐Ÿ’ผ PCI DSS v4.0.1 โ†’ ๐Ÿ’ผ 8.2.6 Inactive user accounts are removed or disabled within 90 days of inactivity.2no data
๐Ÿ’ผ PCI DSS v4.0 โ†’ ๐Ÿ’ผ 8.2.6 Inactive user accounts are removed or disabled within 90 days of inactivity.2no data