Control: 8 Unused IAM user credentials should be removed

Description

AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 90 or greater days to be deactivated or removed.

Disabling or removing unnecessary credentials will reduce the window of opportunity for credentials associated with a compromised or abandoned users to be used.

Remediation

From Console:

Perform the following action to disable user console password:

Sign into the AWS console and navigate to the IAM Dashboard.
In the left navigation pane, choose Users.
Select the User name whose Console last sign-in is greater than 90 days.
Click on Security credentials tab.
In section Sign-in credentials, Console password click Manage.
Select Disable, click Apply

Perform the following action to deactivate access keys:

Sign into the AWS console as an Administrator and navigate to the IAM Dashboard.
In the left navigation pane, choose Users.
Click on the User name for which access key is over 90 days old.
Click on Security credentials tab.
Click on the Make inactive to deactivate the key that is over 90 days old and that have not been used.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_iam_8

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_iam_8 --share

SQL

This control uses a named query:

select
  user_arn as resource,
  case
    when user_name = '<root_account>'
      then 'info'
    when password_enabled and password_last_used is null and password_last_changed < (current_date - interval '90' day)
      then 'alarm'
    when password_enabled and password_last_used  < (current_date - interval '90' day)
      then 'alarm'
    when access_key_1_active and access_key_1_last_used_date is null and access_key_1_last_rotated < (current_date - interval '90' day)
      then 'alarm'
    when access_key_1_active and access_key_1_last_used_date  < (current_date - interval '90' day)
      then 'alarm'
    when access_key_2_active and access_key_2_last_used_date is null and access_key_2_last_rotated < (current_date - interval '90' day)
      then 'alarm'
    when access_key_2_active and access_key_2_last_used_date  < (current_date - interval '90' day)
      then 'alarm'
    else 'ok'
  end status,
  user_name ||
    case
      when not password_enabled
        then ' password not enabled,'
      when password_enabled and password_last_used is null
        then ' password created ' || to_char(password_last_changed, 'DD-Mon-YYYY') || ' never used,'
      else
        ' password used ' || to_char(password_last_used, 'DD-Mon-YYYY') || ','
    end ||
    case
      when not access_key_1_active
        then ' key 1 not enabled,'
      when access_key_1_active and access_key_1_last_used_date is null
        then ' key 1 created ' || to_char(access_key_1_last_rotated, 'DD-Mon-YYYY') || ' never used,'
      else
        ' key 1 used ' || to_char(access_key_1_last_used_date, 'DD-Mon-YYYY') || ','
    end ||
      case
      when not access_key_2_active
        then ' key 2 not enabled.'
      when access_key_2_active and access_key_2_last_used_date is null
        then ' key 2 created ' || to_char(access_key_2_last_rotated, 'DD-Mon-YYYY') || ' never used.'
      else
        ' key 2 used ' || to_char(access_key_2_last_used_date, 'DD-Mon-YYYY') || '.'
    end
  as reason
  , account_id
from
  aws_iam_credential_report;

Control: 8 Unused IAM user credentials should be removed

Description

Remediation

From Console:

Usage

SQL

Tags