Skip to main content

🛡️ AWS IAM User with credentials unused for 45 days or more is not disabled🟢

  • Contextual name: 🛡️ User with credentials unused for 45 days or more is not disabled🟢
  • ID: /ce/ca/aws/iam/disable-user-with-unused-credentials-45-days-and-more
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-ac93bf151

Description​

Open File

Description​

AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.

Rationale​

Disabling or removing unnecessary credentials will reduce the window of opportunity for credentials associated with a compromised or abandoned account to be used.

Audit​

Perform the following to determine if unused credentials exist:

From Console​
  1. Login to the AWS Management Console.
  2. Click Services.
  3. Click IAM.
  4. Click on Users.
  5. Click the Settings (gear) icon.
  6. Select Console last sign-in, Access key last used, and Access Key Id.
  7. Click on Close.
  8. Check and ensure that Console last sign-in is less than 45 days ago.

Note: Never means the user has never logged in.

  1. Check and ensure that Access key age is less than 45 days and that Access key last used does not say None.

If the user hasn't signed into the Console in the last 45 days or Access keys are over 45 days old refer to the remediation.

... see more

Remediation​

Open File

Remediation​

From Console​

Perform the following to manage Unused Password (IAM user console access):

  1. Login to the AWS Management Console.
  2. Click Services.
  3. Click IAM.
  4. Click on Users.
  5. Click on Security Credentials.
  6. Select user whose Console last sign-in is greater than 45 days.
  7. Click Security credentials.
  8. In section Sign-in credentials, Console password click Manage.
  9. Under Console Access select Disable.
  10. Click Apply.

Perform the following to deactivate Access Keys:

  1. Login to the AWS Management Console.
  2. Click Services.
  3. Click IAM.
  4. Click on Users.
  5. Click on Security Credentials.
  6. Select any access keys that are over 45 days old and that have been used and click on Make Inactive.
  7. Select any access keys that are over 45 days old and that have not been used and click the X to Delete.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [IAM.8] Unused IAM user credentials should be removed1no data
💼 CIS AWS v1.4.0 → 💼 1.12 Ensure credentials unused for 45 days or greater are disabled1no data
💼 CIS AWS v1.5.0 → 💼 1.12 Ensure credentials unused for 45 days or greater are disabled - Level 1 (Automated)1no data
💼 CIS AWS v2.0.0 → 💼 1.12 Ensure credentials unused for 45 days or greater are disabled - Level 1 (Automated)1no data
💼 CIS AWS v3.0.0 → 💼 1.12 Ensure credentials unused for 45 days or greater are disabled - Level 1 (Automated)1no data
💼 CIS AWS v4.0.0 → 💼 1.12 Ensure credentials unused for 45 days or more are disabled (Automated)1no data
💼 CIS AWS v4.0.1 → 💼 1.12 Ensure credentials unused for 45 days or more are disabled (Automated)1no data
💼 CIS AWS v5.0.0 → 💼 1.11 Ensure credentials unused for 45 days or more are disabled (Automated)1no data
💼 CIS AWS v6.0.0 → 💼 2.11 Ensure credentials unused for 45 days or more are disabled (Automated)1no data
💼 Cloudaware Framework → 💼 Credential Lifecycle Management18no data
💼 FedRAMP High Security Controls → 💼 AC-2 Account Management (L)(M)(H)10836no data
💼 FedRAMP High Security Controls → 💼 AC-2(1) Automated System Account Management (M)(H)16no data
💼 FedRAMP High Security Controls → 💼 AC-2(3) Disable Accounts (M)(H)4no data
💼 FedRAMP High Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)3767no data
💼 FedRAMP High Security Controls → 💼 AC-6 Least Privilege (M)(H)81156no data
💼 FedRAMP Low Security Controls → 💼 AC-2 Account Management (L)(M)(H)4no data
💼 FedRAMP Low Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)67no data
💼 FedRAMP Moderate Security Controls → 💼 AC-2 Account Management (L)(M)(H)936no data
💼 FedRAMP Moderate Security Controls → 💼 AC-2(1) Automated System Account Management (M)(H)16no data
💼 FedRAMP Moderate Security Controls → 💼 AC-2(3) Disable Accounts (M)(H)4no data
💼 FedRAMP Moderate Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)67no data
💼 FedRAMP Moderate Security Controls → 💼 AC-6 Least Privilege (M)(H)656no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events120no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events83no data
💼 NIST CSF v2.0 → 💼 PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization38no data
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties91no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected112no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage70no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-2 Account Management132035no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(1) Account Management _ Automated System Account Management416no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(3) Account Management _ Disable Accounts14no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-3 Access Enforcement15537no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-3(7) Access Enforcement _ Role-based Access Control14no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-3(15) Access Enforcement _ Discretionary and Mandatory Access Control11no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-6 Least Privilege102349no data
💼 PCI DSS v3.2.1 → 💼 8.1.4 Remove/disable inactive user accounts within 90 days.1no data
💼 PCI DSS v4.0.1 → 💼 8.2.6 Inactive user accounts are removed or disabled within 90 days of inactivity.1no data
💼 PCI DSS v4.0 → 💼 8.2.6 Inactive user accounts are removed or disabled within 90 days of inactivity.1no data