Ensure credentials unused for 45 days or more are disabled

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Perform the following to determine if unused credentials exist: From Console: 1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam 2. Click on Users 3. Click the Settings (gear) icon 4. Select Console last sign-in, Access key last used, and Access Key Id 5. Click on Confirm 6. Check and ensure that Console last sign-in is less than 45 days ago. Note - - means the user has never logged in. 7. If credentials have not been used within 45 days, refer to remediation From Command Line: Remove Access Key: 1. Generate and review the credential report: aws iam generate-credential-report aws iam get-credential-report --query 'Content' --output text | base64 -d 2. Review the following fields: - password_last_used - access_key_1_last_used_date - access_key_2_last_used_date 3. Identify any credentials unused for 45 days or more

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

From Console: Perform the following to deactivate or remove unused credentials: 1. Login to the AWS Management Console and open the IAM console 2. Click on the User 3. Select the user 4. Click Security Credentials Disable Console Access: 5. In the Console sign-in section, select Manage console access 6. If Console last sign-in is greater than 45 days, select Disable access Deactivate or Delete Access Keys: 7. In the Access keys section: - Deactivate unused keys, or - Delete keys that are no longer required From Command Line: 1. Delete unused access keys: aws iam delete-access-key --access-key-id <access-key-id> --user-name <user- name> 2. Remove console access: aws iam delete-login-profile --user-name <user-name>