Control: 1.12 Ensure credentials unused for 45 days or greater are disabled

Description

AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.

Disabling or removing unnecessary credentials will reduce the window of opportunity for credentials associated with a compromised or abandoned account to be used.

Remediation

From Console:

Perform the following to manage Unused Password (IAM user console access)

Login to the AWS Management Console:
Click Services.
Click IAM.
Click on Users.
Click on Security Credentials.
Select user whose Console last sign-in is greater than 45 days.
Click Security credentials.
In section Sign-incredentials, Console password click Manage.
Under Console Access select Disable.
Click Apply

Perform the following to deactivate Access Keys:

Login to the AWS Management Console:
Click Services.
Click IAM.
Click on Users.
Click on Security Credentials.
Select any access keys that are over 45 days old and that have been used and

Click on Make inactive.

Select any access keys that are over 45 days old and that have not been used and

Click the X to Delete.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.cis_v200_1_12

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.cis_v200_1_12 --share

SQL

This control uses a named query:

select
  user_arn as resource,
  case
    --root_account will have always password associated even though AWS credential report returns 'not_supported' for password_enabled
    when user_name = '<root_account>'
      then 'info'
    when password_enabled and password_last_used is null and password_last_changed < (current_date - interval '45' day)
      then 'alarm'
    when password_enabled and password_last_used  < (current_date - interval '45' day)
      then 'alarm'
    when access_key_1_active and access_key_1_last_used_date is null and access_key_1_last_rotated < (current_date - interval '45' day)
      then 'alarm'
    when access_key_1_active and access_key_1_last_used_date  < (current_date - interval '45' day)
      then 'alarm'
    when access_key_2_active and access_key_2_last_used_date is null and access_key_2_last_rotated < (current_date - interval '45' day)
      then 'alarm'
    when access_key_2_active and access_key_2_last_used_date  < (current_date - interval '45' day)
      then 'alarm'
    else 'ok'
  end status,
  user_name ||
    case
      when not password_enabled
        then ' password not enabled,'
      when password_enabled and password_last_used is null
        then ' password created ' || to_char(password_last_changed, 'DD-Mon-YYYY') || ' never used,'
      else
        ' password used ' || to_char(password_last_used, 'DD-Mon-YYYY') || ','
    end ||
    case
      when not access_key_1_active
        then ' key 1 not enabled,'
      when access_key_1_active and access_key_1_last_used_date is null
        then ' key 1 created ' || to_char(access_key_1_last_rotated, 'DD-Mon-YYYY') || ' never used,'
      else
        ' key 1 used ' || to_char(access_key_1_last_used_date, 'DD-Mon-YYYY') || ','
    end ||
      case
      when not access_key_2_active
        then ' key 2 not enabled.'
      when access_key_2_active and access_key_2_last_used_date is null
        then ' key 2 created ' || to_char(access_key_2_last_rotated, 'DD-Mon-YYYY') || ' never used.'
      else
        ' key 2 used ' || to_char(access_key_2_last_used_date, 'DD-Mon-YYYY') || '.'
    end
  as reason
  , account_id
from
  aws_iam_credential_report;

Control: 1.12 Ensure credentials unused for 45 days or greater are disabled

Description

Remediation

From Console:

Usage

SQL

Tags