AWS_IAM_48

Ensure credentials unused for 45 days or greater are disabled

Description

AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.

Remediation

From Portal:
1. Login to the AWS Management Console
2. Click Services
3. Click IAM
4. Click on Users
5. Click on Security Credentials
6. In section Sign-in credentials, Console password click Manage
7. Under Console Access select Disable
8. Click Apply

From Command Line:
To disable an IAM User console password, run:
aws iam delete-login-profile –user-name USER-NAME

References:
1. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_finding-unused.html
2. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-login-profile.html

Service

IAM

Severity

Medium

Compliance

Mapping

We are now live on AWS Marketplace.
The integrated view of your cloud infrastructure is now easier than ever!