📝 AWS IAM User has more than one active access key 🟢

• Contextual name: 📝 User has more than one active access key 🟢
• ID: /ce/ca/aws/iam/user-has-more-than-one-active-access-key
• Located in: 📁 AWS IAM

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Unnecessary Access Keys
• Internal
  • dec-x-30795016

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-30795016	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 AWS IAM User
  • 🔌 AWS IAM User - credReport.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Access keys are long-term credentials for an IAM user or the AWS account root user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)

Rationale

One of the best ways to protect your account is to not allow users to have multiple access keys.

Audit

From Console

1. Sign in to the AWS Management Console and navigate to IAM dashboard at https://console.aws.amazon.com/iam/.

2. In the left navigation panel, choose Users.

3. Click on the IAM user name that you want to examine.

4. On the IAM user configuration page, select Security Credentials tab.

5. Under Access Keyssection, in the Status column, check the current status for each access key associated with the IAM user. If the selected IAM user has more than one access key activated then the users access configuration does not adhere to security best practices and the risk of accidental exposures increases.

• Repeat steps no. 3 – 5 for each IAM user in your AWS account.

From Command Line

... see more

Remediation

Open File

Remediation

From Console

1. Sign in to the AWS Management Console and navigate to IAM dashboard at https://console.aws.amazon.com/iam/.
2. In the left navigation panel, choose Users.
3. Click on the IAM user name that you want to examine.
4. On the IAM user configuration page, select Security Credentials tab.
5. In Access Keys section, choose one access key that is less than 90 days old. This should be the only active key used by this IAM user to access AWS resources programmatically. Test your application(s) to make sure that the chosen access key is working.
6. In the same Access Keys section, identify your non-operational access keys (other than the chosen one) and deactivate it by clicking the Make Inactive link.
7. If you receive the Change Key Status confirmation box, click Deactivate to switch off the selected key.
8. Repeat steps no. 3 – 7 for each IAM user in your AWS account.

From Command Line

1. Using the IAM user and access key information provided in the Audit CLI, choose one access key that is less than 90 days old. This should be the only active key used by this IAM user to access AWS resources programmatically. Test your application(s) to make sure that the chosen access key is working.

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 4 Cryptographic key management refers to the generation, distribution, storage, renewal, revocation, recovery, archiving and destruction of encryption keys. Effective cryptographic key management ensures that controls are in place to reduce the risk of compromise of the security of cryptographic keys. Any compromise of the security of cryptographic keys could, in turn, lead to a compromise of the security of the information assets protected by the cryptographic technique deployed.		6	7
💼 APRA CPG 234 → 💼 44c loss of, or unauthorised access to, encryption keys safeguarding extremely critical or sensitive information assets.		8	10
💼 CIS AWS v1.3.0 → 💼 1.13 Ensure there is only one active access key available for any single IAM user		1	1
💼 CIS AWS v1.4.0 → 💼 1.13 Ensure there is only one active access key available for any single IAM user		1	1
💼 CIS AWS v1.5.0 → 💼 1.13 Ensure there is only one active access key available for any single IAM user - Level 1 (Automated)		1	1
💼 CIS AWS v2.0.0 → 💼 1.13 Ensure there is only one active access key available for any single IAM user - Level 1 (Automated)		1	1
💼 CIS AWS v3.0.0 → 💼 1.13 Ensure there is only one active access key available for any single IAM user - Level 1 (Automated)		1	1
💼 CIS AWS v4.0.0 → 💼 1.13 Ensure there is only one active access key for any single IAM user (Automated)			1
💼 CIS AWS v4.0.1 → 💼 1.13 Ensure there is only one active access key for any single IAM user (Automated)			1
💼 CIS AWS v5.0.0 → 💼 1.12 Ensure there is only one active access key for any single IAM user (Automated)			1
💼 Cloudaware Framework → 💼 Credential Lifecycle Management			17
💼 FedRAMP High Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	6	14	20
💼 FedRAMP High Security Controls → 💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)	1	9	11
💼 FedRAMP Low Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	1		20
💼 FedRAMP Low Security Controls → 💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)			11
💼 FedRAMP Moderate Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	4		20
💼 FedRAMP Moderate Security Controls → 💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)			11
💼 GDPR → 💼 Art. 25 Data protection by design and by default		10	10
💼 ISO/IEC 27001:2013 → 💼 A.9.2.4 Management of secret authentication information of users		8	10
💼 ISO/IEC 27001:2013 → 💼 A.10.1.2 Key management		9	11
💼 NIST CSF v1.1 → 💼 PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes		19	22
💼 NIST CSF v1.1 → 💼 PR.AC-7: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals' security and privacy risks and other organizational risks)		19	22
💼 NIST CSF v1.1 → 💼 PR.DS-1: Data-at-rest is protected		15	19
💼 NIST CSF v1.1 → 💼 PR.DS-2: Data-in-transit is protected		14	21
💼 NIST CSF v2.0 → 💼 PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization			23
💼 NIST CSF v2.0 → 💼 PR.AA-03: Users, services, and hardware are authenticated			22
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties			58
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected			82
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected			69
💼 NIST SP 800-53 Revision 4 → 💼 SC-12 CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT	5	4	4