AWS_IAM_29

Ensure there are no Unnecessary IAM SSH Public Keys for AWS CodeCommit

Description

Deactivate any unnecessary IAM SSH public keys used to authenticate to AWS CodeCommit repositories. Amazon allows you to assign maximum two active SSH keys, however having two keys is recommended only during the key rotation process.

Remediation

1. Login to the AWS Management Console.

2. Go to IAM dashboard.

3. In the left navigation panel, choose Users.

4. Click on the IAM user name that you want to examine.

5. On the IAM user configuration page, select Security Credentials tab.

6. In SSH keys for AWS CodeCommit section, choose the active SSH public key that will be used to access your AWS CodeCommit repositories, copy its SSH Key ID then test the key by connecting to the necessary CodeCommit repositories. This test is performed to ensure that the chosen SSH key is currently working.

7. Now identify your non-operational SSH key (other than the chosen one) and deactivate it by clicking the Make Inactive link:

8. In the Change Key Status confirmation box, click Deactivate to turn off the selected key.

Service

IAM

Severity

Medium

Compliance

Mapping

We are now live on AWS Marketplace.
The integrated view of your cloud infrastructure is now easier than ever!