Control: 1.12 Ensure credentials unused for 45 days or greater are disabled
Description
AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.
Disabling or removing unnecessary credentials will reduce the window of opportunity for credentials associated with a compromised or abandoned account to be used.
Remediation
From Console:
Perform the following to manage Unused Password (IAM user console access)
- Login to the AWS Management Console:
- Click
Services
. - Click
IAM
. - Click on
Users
. - Click on
Security Credentials
. - Select user whose
Console last sign-in
is greater than 45 days. - Click
Security credentials
. - In section
Sign-incredentials
,Console password
clickManage
. - Under Console Access select
Disable
. - Click
Apply
Perform the following to deactivate Access Keys:
- Login to the AWS Management Console:
- Click
Services
. - Click
IAM
. - Click on
Users
. - Click on
Security Credentials
. - Select any access keys that are over 45 days old and that have been used and
- Click on
Make inactive
.
- Select any access keys that are over 45 days old and that have not been used and
- Click the X to
Delete
.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.cis_v300_1_12
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.cis_v300_1_12 --share
SQL
This control uses a named query:
select user_arn as resource, case --root_account will have always password associated even though AWS credential report returns 'not_supported' for password_enabled when user_name = '<root_account>' then 'info' when password_enabled and password_last_used is null and password_last_changed < (current_date - interval '45' day) then 'alarm' when password_enabled and password_last_used < (current_date - interval '45' day) then 'alarm' when access_key_1_active and access_key_1_last_used_date is null and access_key_1_last_rotated < (current_date - interval '45' day) then 'alarm' when access_key_1_active and access_key_1_last_used_date < (current_date - interval '45' day) then 'alarm' when access_key_2_active and access_key_2_last_used_date is null and access_key_2_last_rotated < (current_date - interval '45' day) then 'alarm' when access_key_2_active and access_key_2_last_used_date < (current_date - interval '45' day) then 'alarm' else 'ok' end status, user_name || case when not password_enabled then ' password not enabled,' when password_enabled and password_last_used is null then ' password created ' || to_char(password_last_changed, 'DD-Mon-YYYY') || ' never used,' else ' password used ' || to_char(password_last_used, 'DD-Mon-YYYY') || ',' end || case when not access_key_1_active then ' key 1 not enabled,' when access_key_1_active and access_key_1_last_used_date is null then ' key 1 created ' || to_char(access_key_1_last_rotated, 'DD-Mon-YYYY') || ' never used,' else ' key 1 used ' || to_char(access_key_1_last_used_date, 'DD-Mon-YYYY') || ',' end || case when not access_key_2_active then ' key 2 not enabled.' when access_key_2_active and access_key_2_last_used_date is null then ' key 2 created ' || to_char(access_key_2_last_rotated, 'DD-Mon-YYYY') || ' never used.' else ' key 2 used ' || to_char(access_key_2_last_used_date, 'DD-Mon-YYYY') || '.' end as reason , account_idfrom aws_iam_credential_report;