Medium
IAM
Unused IAM user credentials should be removed
CISNISTPCI DSS
Description
Flags IAM users whose passwords or access keys have not been used for 90 days. Removing unused credentials reduces the attack surface from abandoned or compromised accounts.
Remediation
To remove unused IAM user credentials and disable password login, follow these steps:
Steps
- Log into the AWS Management Console with an account that has administrative privileges.
- Navigate to the IAM dashboard and select 'Users' from the navigation pane.
- Click on the username to view their security credentials.
- Under the 'Access keys' section, check the 'Last used' date.
- Communicate with the IAM user to coordinate the creation of new credentials if needed.
- To remove an access key, click on 'Make inactive' and then 'Delete'.
- Check if the user has 'Console sign-in' enabled and disable if unused.
- Review other credentials such as SSH keys and signing certificates.
- Regularly audit IAM user credentials to ensure compliance.
Compliance
CISNISTPCI DSS