Ensure credentials unused for 45 days or more are disabled

高等級 1人工審核aws

說明

AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused for 45 days or more be deactivated or removed. Disabling or removing unused credentials reduces the window of opportunity for credentials associated with a compromised or abandoned account to be used.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Perform the following to determine if unused credentials exist: From Console: 1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam 2. Click on Users 3. Click the Settings (gear) icon 4. Select Console last sign-in, Access key last used, and Access Key Id 5. Click on Confirm 6. Check and ensure that Console last sign-in is less than 45 days ago. Note - - means the user has never logged in. 7. If credentials have not been used within 45 days, refer to remediation From Command Line: Remove Access Key: 1. Generate and review the credential report: aws iam generate-credential-report aws iam get-credential-report --query 'Content' --output text | base64 -d 2. Review the following fields: - password_last_used - access_key_1_last_used_date - access_key_2_last_used_date 3. Identify any credentials unused for 45 days or more

修補方式

修補方法: 操作指南或基礎設施修補檔

From Console: Perform the following to deactivate or remove unused credentials: 1. Login to the AWS Management Console and open the IAM console 2. Click on the User 3. Select the user 4. Click Security Credentials Disable Console Access: 5. In the Console sign-in section, select Manage console access 6. If Console last sign-in is greater than 45 days, select Disable access Deactivate or Delete Access Keys: 7. In the Access keys section: - Deactivate unused keys, or - Delete keys that are no longer required From Command Line: 1. Delete unused access keys: aws iam delete-access-key --access-key-id <access-key-id> --user-name <user- name> 2. Remove console access: aws iam delete-login-profile --user-name <user-name>

屬性

作業系統: 不限
標籤: awscloud
參考資料: CIS Amazon Web Services Foundations Benchmark v7.0.0 - 2.11 Ensure credentials unused for 45 days or more are disabled