All checks
Medium
Unused IAM user credentials should be removed
Flags IAM users with a console password or active access key unused for 90 days or more; removing them narrows what an abandoned or compromised account exposes. One stale credential fails the user even beside one used today, and a never-used key counts from its creation, a never-used password from the user's.
- service
- IAM
- severity
- Medium
- scope
- evaluated once per account
How to fix it
- Can break clients: A key that looks abandoned may still run a forgotten pipeline or script, so wait after deactivating it and delete it only once nothing has failed.
- Affects another check: Clearing this leaves IAM.22 failing while the user still holds any credential unused for 45 days.
In the console
IAM → Users → the user → Security credentials
- Console sign-in
- Disable access (Manage console access), if the password is unused for 90 days
- Access keys
- Each active key unused for 90 days: Actions → Deactivate, which clears this and can be undone; Delete later
With the AWS CLI
aws iam update-access-key --user-name <user-name> --access-key-id <access-key-id> --status InactiveSee which of your accounts this check is failing on.
Book a live scan