Check Details

• Resource: Users
• Check: Disable unused user credentials
• Risk: Unused access keys may be exploited if exposed

Remediation via AWS Console

1. Sign in to the AWS Management Console and open the IAM console.

   
2. Click Users and select the IAM user.
3. Open the Security credentials tab.

4. In the Access keys section, review:

   • Last used date
   • Age of the access key

   Access keys not used for 90 days or more should be disabled.

5. For each unused access key, click Actions and select Make inactive.

   
6. Repeat steps 2–5 for all IAM users in the AWS account.

Remediation via AWS CLI

1. Log in to the AWS Management Console and click the CloudShell icon (>_) in the top-right corner.

   
2. Identify an access key that is less than 90 days old and should remain active.

3. Deactivate the old unused access key:

   

   aws iam update-access-key \
   --user-name <user-name> \
   --access-key-id <old-access-key-id> \
   --status Inactive
   

4. Verify the access key status:

   

   aws iam list-access-keys --user-name <user-name>
   

5. Repeat steps 2–4 for each IAM user in your AWS account.