Ensure credentials unused for 45 days or more are disabled

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Perform the following to determine if unused credentials exist: From Console: 1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam 2. Click on Users 3. Click the Settings (gear) icon 4. Select Console last sign-in, Access key last used, and Access Key Id 5. Click on Confirm 6. Check and ensure that Console last sign-in is less than 45 days ago. Note - - means the user has never logged in. 7. If credentials have not been used within 45 days, refer to remediation From Command Line: Remove Access Key: 1. Generate and review the credential report: aws iam generate-credential-report aws iam get-credential-report --query 'Content' --output text | base64 -d 2. Review the following fields: - password_last_used - access_key_1_last_used_date - access_key_2_last_used_date 3. Identify any credentials unused for 45 days or more

조치 방법

조치 방식: 가이드 또는 인프라 패치

From Console: Perform the following to deactivate or remove unused credentials: 1. Login to the AWS Management Console and open the IAM console 2. Click on the User 3. Select the user 4. Click Security Credentials Disable Console Access: 5. In the Console sign-in section, select Manage console access 6. If Console last sign-in is greater than 45 days, select Disable access Deactivate or Delete Access Keys: 7. In the Access keys section: - Deactivate unused keys, or - Delete keys that are no longer required From Command Line: 1. Delete unused access keys: aws iam delete-access-key --access-key-id <access-key-id> --user-name <user- name> 2. Remove console access: aws iam delete-login-profile --user-name <user-name>