Check Details

• Resource: Users
• Check: Enforce active key limit
• Risk: Multiple active access keys increase the risk of unauthorized access

Remediation via AWS Console

1. Sign in to the AWS Management Console and open the IAM console.

   
2. Click Users and select the IAM user.
3. Open the Security credentials tab.
4. In the Access keys section, identify the access key that is less than 90 days old. This key should be the only active key used by the IAM user.

5. In the same Access keys section, locate any additional access keys. Click Actions next to those keys and select Make inactive.

   
6. Repeat steps 2–5 for each IAM user in your AWS account.

Remediation via AWS CLI

1. Log in to the AWS Management Console and click the CloudShell icon (>_) in the top-right corner.

   
2. Identify the access key that is less than 90 days old. This key should remain active.

3. Deactivate the old access key:

   

   aws iam update-access-key \
   --user-name <user-name> \
   --access-key-id <old-access-key-id> \
   --status Inactive
   

4. Verify the access key status:

   

   aws iam list-access-keys --user-name <user-name>
   

5. Repeat steps 2–4 for each IAM user in your AWS account.