Skip to main content

๐Ÿ›ก๏ธ AWS IAM User with console and programmatic access set during the initial creation๐ŸŸขโšช

  • Contextual name: ๐Ÿ›ก๏ธ User with console and programmatic access set during the initial creation๐ŸŸขโšช
  • ID: /ce/ca/aws/iam/user-with-console-and-programmatic-access-set-during-creation
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Similar Policiesโ€‹

Similar Internal Rulesโ€‹

RulePoliciesFlags
โœ‰๏ธ dec-x-b10e98af1

Descriptionโ€‹

Open File

Descriptionโ€‹

The AWS console defaults to no checkboxes selected when creating a new IAM user. When creating IAM user credentials, you have to determine what type of access they require.

Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user.

AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.

Rationaleโ€‹

Requiring the additional steps to be taken by the user for programmatic access after their profile has been created provides a stronger indication of intent that access keys are (a) necessary for their work and (b) once the access key is established on an account, the keys may be in use somewhere in the organization.

Note: Even if it is known the user will need access keys, require them to create the keys themselves or submit a support ticket to have them created as a separate step from user creation.

... see more

Remediationโ€‹

Open File

Remediationโ€‹

Perform the following to delete access keys that do not pass the audit:

From Consoleโ€‹

  1. Log in to the AWS Management Console.
  2. Click Services.
  3. Click IAM.
  4. Click on Users.
  5. Click on Security Credentials.
  6. As an Administrator:
    • Click on the X (Delete) for keys that were created at the same time as the user profile but have not been used.
  7. As an IAM User:
    • Click on the X (Delete) for keys that were created at the same time as the user profile but have not been used.

From Command Lineโ€‹

aws iam delete-access-key --access-key-id {{access-key-id-listed}} --user-name {{user-name}}

policy.yamlโ€‹

Open File

Linked Framework Sectionsโ€‹

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
๐Ÿ’ผ CIS AWS v1.2.0 โ†’ ๐Ÿ’ผ 1.21 Do not setup access keys during initial user setup for all IAM users that have a console password11no data
๐Ÿ’ผ CIS AWS v1.3.0 โ†’ ๐Ÿ’ผ 1.11 Do not setup access keys during initial user setup for all IAM users that have a console password11no data
๐Ÿ’ผ CIS AWS v1.4.0 โ†’ ๐Ÿ’ผ 1.11 Do not setup access keys during initial user setup for all IAM users that have a console password11no data
๐Ÿ’ผ CIS AWS v1.5.0 โ†’ ๐Ÿ’ผ 1.11 Do not setup access keys during initial user setup for all IAM users that have a console password - Level 1 (Automated)11no data
๐Ÿ’ผ CIS AWS v2.0.0 โ†’ ๐Ÿ’ผ 1.11 Do not setup access keys during initial user setup for all IAM users that have a console password - Level 1 (Manual)11no data
๐Ÿ’ผ CIS AWS v3.0.0 โ†’ ๐Ÿ’ผ 1.11 Do not setup access keys during initial user setup for all IAM users that have a console password - Level 1 (Manual)11no data
๐Ÿ’ผ CIS AWS v4.0.0 โ†’ ๐Ÿ’ผ 1.11 Do not create access keys during initial setup for IAM users with a console password (Manual)1no data
๐Ÿ’ผ CIS AWS v4.0.1 โ†’ ๐Ÿ’ผ 1.11 Do not create access keys during initial setup for IAM users with a console password (Manual)1no data
๐Ÿ’ผ CIS AWS v5.0.0 โ†’ ๐Ÿ’ผ 1.10 Do not create access keys during initial setup for IAM users with a console password (Manual)1no data
๐Ÿ’ผ CIS AWS v6.0.0 โ†’ ๐Ÿ’ผ 2.10 Do not create access keys during initial setup for IAM users with a console password (Manual)1no data
๐Ÿ’ผ Cloudaware Framework โ†’ ๐Ÿ’ผ Credential Lifecycle Management32no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-6(2) Non-privileged Access for Nonsecurity Functions (M)(H)16no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-6(5) Privileged Accounts (M)(H)35no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ IA-5 Authenticator Management (L)(M)(H)61437no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ IA-5(2) Public Key-based Authentication (M)(H)11no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ IA-5(13) Expiration of Cached Authenticators (H)11no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ SC-12 Cryptographic Key Establishment and Management (L)(M)(H)1912no data
๐Ÿ’ผ FedRAMP Low Security Controls โ†’ ๐Ÿ’ผ IA-5 Authenticator Management (L)(M)(H)137no data
๐Ÿ’ผ FedRAMP Low Security Controls โ†’ ๐Ÿ’ผ SC-12 Cryptographic Key Establishment and Management (L)(M)(H)12no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-6(2) Non-privileged Access for Nonsecurity Functions (M)(H)6no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-6(5) Privileged Accounts (M)(H)5no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ IA-5 Authenticator Management (L)(M)(H)437no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ IA-5(2) Public Key-based Authentication (M)(H)1no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ SC-12 Cryptographic Key Establishment and Management (L)(M)(H)12no data
๐Ÿ’ผ ISO/IEC 27001:2013 โ†’ ๐Ÿ’ผ A.9.2.4 Management of secret authentication information of users810no data
๐Ÿ’ผ ISO/IEC 27001:2013 โ†’ ๐Ÿ’ผ A.10.1.2 Key management912no data
๐Ÿ’ผ ISO/IEC 27001:2022 โ†’ ๐Ÿ’ผ 5.10 Acceptable use of information and other associated assets1228no data
๐Ÿ’ผ ISO/IEC 27001:2022 โ†’ ๐Ÿ’ผ 5.15 Access control1532no data
๐Ÿ’ผ ISO/IEC 27001:2022 โ†’ ๐Ÿ’ผ 8.2 Privileged access rights710no data
๐Ÿ’ผ ISO/IEC 27001:2022 โ†’ ๐Ÿ’ผ 8.3 Information access restriction1125no data
๐Ÿ’ผ ISO/IEC 27001:2022 โ†’ ๐Ÿ’ผ 8.4 Access to source code923no data
๐Ÿ’ผ NIST CSF v1.1 โ†’ ๐Ÿ’ผ PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes1934no data
๐Ÿ’ผ NIST CSF v1.1 โ†’ ๐Ÿ’ผ PR.AC-6: Identities are proofed and bound to credentials and asserted in interactions413no data
๐Ÿ’ผ NIST CSF v1.1 โ†’ ๐Ÿ’ผ PR.AC-7: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals' security and privacy risks and other organizational risks)2024no data
๐Ÿ’ผ NIST CSF v1.1 โ†’ ๐Ÿ’ผ PR.DS-1: Data-at-rest is protected1530no data
๐Ÿ’ผ NIST CSF v1.1 โ†’ ๐Ÿ’ผ PR.DS-2: Data-in-transit is protected1653no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization47no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions13no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.AA-03: Users, services, and hardware are authenticated54no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties144no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected196no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected167no data
๐Ÿ’ผ NIST SP 800-53 Revision 4 โ†’ ๐Ÿ’ผ IA-5 (13) EXPIRATION OF CACHED AUTHENTICATORS11no data
๐Ÿ’ผ NIST SP 800-53 Revision 4 โ†’ ๐Ÿ’ผ IA-5 AUTHENTICATOR MANAGEMENT1522no data
๐Ÿ’ผ NIST SP 800-53 Revision 4 โ†’ ๐Ÿ’ผ SC-12 (2) SYMMETRIC KEYS11no data
๐Ÿ’ผ NIST SP 800-53 Revision 4 โ†’ ๐Ÿ’ผ SC-12 (3) ASYMMETRIC KEYS11no data
๐Ÿ’ผ NIST SP 800-53 Revision 4 โ†’ ๐Ÿ’ผ SC-12 CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT545no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-6(2) Least Privilege _ Non-privileged Access for Nonsecurity Functions46no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-6(5) Least Privilege _ Privileged Accounts33no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ SC-12(2) Cryptographic Key Establishment and Management _ Symmetric Keys14no data
๐Ÿ’ผ SOC 2 โ†’ ๐Ÿ’ผ CC6.1-8 Manages Identification and Authentication1825no data