turbot/steampipe-mod-aws-compliance

Control: 1.3 Ensure credentials unused for 90 days or greater are disabled

Description

AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 90 or greater days be removed or deactivated.

Disabling or removing unnecessary credentials will reduce the window of opportunity for credentials associated with a compromised or abandoned account to be used.

Remediation

Perform the following to remove or deactivate credentials:

  1. Login to the AWS Management Console:
  2. Click Services.
  3. Click IAM.
  4. Click on Users.
  5. Click on Security Credentials.
  6. As an Administrator.
  • Click on Make Inactive for credentials that have not been used in 90 Days.
  1. As an IAM User.
  • Click on Make Inactive or Delete for credentials which have not been used in 90 Days.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.cis_v120_1_3

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.cis_v120_1_3 --share

SQL

This control uses a named query:

select
user_arn as resource,
case
when user_name = '<root_account>'
then 'info'
when password_enabled and password_last_used is null and password_last_changed < (current_date - interval '90' day)
then 'alarm'
when password_enabled and password_last_used < (current_date - interval '90' day)
then 'alarm'
when access_key_1_active and access_key_1_last_used_date is null and access_key_1_last_rotated < (current_date - interval '90' day)
then 'alarm'
when access_key_1_active and access_key_1_last_used_date < (current_date - interval '90' day)
then 'alarm'
when access_key_2_active and access_key_2_last_used_date is null and access_key_2_last_rotated < (current_date - interval '90' day)
then 'alarm'
when access_key_2_active and access_key_2_last_used_date < (current_date - interval '90' day)
then 'alarm'
else 'ok'
end status,
user_name ||
case
when not password_enabled
then ' password not enabled,'
when password_enabled and password_last_used is null
then ' password created ' || to_char(password_last_changed, 'DD-Mon-YYYY') || ' never used,'
else
' password used ' || to_char(password_last_used, 'DD-Mon-YYYY') || ','
end ||
case
when not access_key_1_active
then ' key 1 not enabled,'
when access_key_1_active and access_key_1_last_used_date is null
then ' key 1 created ' || to_char(access_key_1_last_rotated, 'DD-Mon-YYYY') || ' never used,'
else
' key 1 used ' || to_char(access_key_1_last_used_date, 'DD-Mon-YYYY') || ','
end ||
case
when not access_key_2_active
then ' key 2 not enabled.'
when access_key_2_active and access_key_2_last_used_date is null
then ' key 2 created ' || to_char(access_key_2_last_rotated, 'DD-Mon-YYYY') || ' never used.'
else
' key 2 used ' || to_char(access_key_2_last_used_date, 'DD-Mon-YYYY') || '.'
end
as reason
, account_id
from
aws_iam_credential_report;

Tags