Ensure inactive user for 90 days or greater are disabled

Risk Level: Low
Cloud Entity: IAM User
CloudGuard Rule ID: D9.AWS.IAM.73
Category: Security, Identity, & Compliance

GSL LOGIC

IamUser where firstAccessKey.isActive=true or secondAccessKey.isActive=true or passwordEnabled=true should have firstAccessKey.lastUsedDate after('-90', 'days') or secondAccessKey.lastUsedDate after('-90', 'days') or passwordLastUsed after('-90', 'days')

REMEDIATION

From Portal
Perform the following to deactivate Access Keys:

1. Login to the AWS Management Console.
2. Click Services.
3. Click IAM.
4. Click on Users.
5. Click on Security Credentials.
6. Select any access keys that are over 90 days old and that have been used and click on Make Inactive.
7. Select any access keys that are over 90 days old and that have not been used and click the X to Delete.

Perform the following to manage Unused Password (IAM user console access):

1. Login to the AWS Management Console.
2. Click Services.
3. Click IAM.
4. Click on Users.
5. Click on Security Credentials.
6. In section Sign-in credentials, Console password click Manage.
7. Under Console Access select Disable.
8. Click Apply.

References

1. https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#remove-credentials
2. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_finding-unused.html
3. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_admin-change-user.html
4. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html
5. https://workbench.cisecurity.org/sections/615823/recommendations/1009530

IAM User

An IAM user is an entity that you create in AWS to represent the person or service that uses it to interact with AWS. A user in AWS consists of a name and credentials.

Compliance Frameworks

• AWS CloudGuard Best Practices
• AWS CloudGuard SOC2 based on AICPA TSC 2017
• AWS HITRUST v11.0.0
• AWS MITRE ATT&CK Framework v11.3
• AWS NIST 800-53 Rev 5
• AWS PCI-DSS 4.0
• AWS Security Risk Management