Back to All Checks
Medium IAM

IAM user credentials unused for 45 days should be removed

CIS v5.0.0NIST 800-171

Description

Flags IAM users whose passwords or access keys have not been used in 45 or more days.

Remediation

To remediate unused IAM user credentials, you need to remove or deactivate credentials that have been unused for 45 days or more.

Steps

  1. Navigate to the AWS IAM console
  2. Go to 'Users' in the left navigation
  3. Review the credential report for each user
  4. Identify users with credentials unused for 45+ days
  5. For unused passwords: Remove or reset the password
  6. For unused access keys: Deactivate or delete the access keys
  7. Consider removing the entire user if no longer needed
  8. Document the credential removal for audit purposes
  9. Set up automated monitoring for future unused credentials
  10. Review and update IAM policies to prevent credential accumulation

Compliance

CIS v5.0.0NIST 800-171
Start Your Free Security Check