Control: 2.11 Ensure credentials unused for 45 days or more are disabled

Description

AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused for 45 days or more be deactivated or removed.

Remediation

From Console:

Perform the following to manage Unused Password (IAM user console access)

Login to the AWS Management Console:
Click Services.
Click IAM.
Click on Users.
Click on Security Credentials.
Select user whose Console last sign-in is greater than 45 days.
Click Security credentials.
In section Sign-in credentials, Console password click Manage.
Under Console Access select Disable.
Click Apply.

Perform the following to deactivate Access Keys:

Login to the AWS Management Console:
Click Services.
Click IAM.
Click on Users.
Click on Security Credentials.
Select any access keys that are over 45 days old and that have been used and

Click on Make Inactive

Select any access keys that are over 45 days old and that have not been used and

Click the X to Delete

Default Value:

By default, AWS does not automatically disable or remove IAM user credentials based on age or last use. Console passwords and access keys remain active until manually deactivated or deleted.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.cis_v600_2_11

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.cis_v600_2_11 --share

SQL

This control uses a named query:

select
  user_arn as resource,
  case
    --root_account will have always password associated even though AWS credential report returns 'not_supported' for password_enabled
    when user_name = '<root_account>'
      then 'info'
    when password_enabled and password_last_used is null and password_last_changed < (current_date - interval '45' day)
      then 'alarm'
    when password_enabled and password_last_used  < (current_date - interval '45' day)
      then 'alarm'
    when access_key_1_active and access_key_1_last_used_date is null and access_key_1_last_rotated < (current_date - interval '45' day)
      then 'alarm'
    when access_key_1_active and access_key_1_last_used_date  < (current_date - interval '45' day)
      then 'alarm'
    when access_key_2_active and access_key_2_last_used_date is null and access_key_2_last_rotated < (current_date - interval '45' day)
      then 'alarm'
    when access_key_2_active and access_key_2_last_used_date  < (current_date - interval '45' day)
      then 'alarm'
    else 'ok'
  end status,
  user_name ||
    case
      when not password_enabled
        then ' password not enabled,'
      when password_enabled and password_last_used is null
        then ' password created ' || to_char(password_last_changed, 'DD-Mon-YYYY') || ' never used,'
      else
        ' password used ' || to_char(password_last_used, 'DD-Mon-YYYY') || ','
    end ||
    case
      when not access_key_1_active
        then ' key 1 not enabled,'
      when access_key_1_active and access_key_1_last_used_date is null
        then ' key 1 created ' || to_char(access_key_1_last_rotated, 'DD-Mon-YYYY') || ' never used,'
      else
        ' key 1 used ' || to_char(access_key_1_last_used_date, 'DD-Mon-YYYY') || ','
    end ||
      case
      when not access_key_2_active
        then ' key 2 not enabled.'
      when access_key_2_active and access_key_2_last_used_date is null
        then ' key 2 created ' || to_char(access_key_2_last_rotated, 'DD-Mon-YYYY') || ' never used.'
      else
        ' key 2 used ' || to_char(access_key_2_last_used_date, 'DD-Mon-YYYY') || '.'
    end
  as reason
  , account_id
from
  aws_iam_credential_report;