Identify any inactive IAM users, which are not designed for API access, and disable their access as an extra security measure for protecting your AWS resources against unauthorized access. An IAM user is marked as inactive when is not being used for a specified period of time. By default, Cloud Conformity sets a threshold value of 90 for the number of idle days, however, you have the capability to adjust anytime this threshold based on your requirements.
This rule can help you with the following compliance standards:
- APRA
- MAS
- NIST 800-53 (Rev. 4)
This rule can help you work with the AWS Well-Architected Framework
This rule resolution is part of the Cloud Conformity Security & Compliance tool for AWS
Disabling access for inactive IAM users can reduce the risk of unauthorized access to your AWS resources and help you manage the user-based access more efficiently.
Audit
To identify any IAM users that have not been logged into AWS account for more than 90 days, perform the following:
Remediation / Resolution
To disable the password-based access for any inactive IAM users and terminate their ability to access AWS resources through the Management Console, perform the following:
References
- AWS Documentation
- AWS Identity and Access Management FAQs
- Managing IAM Users
- AWS Command Line Interface (CLI) Documentation
- iam
- list-users
- list-access-keys
- delete-login-profile
Unlock the Remediation Steps
Gain free unlimited access
to our full Knowledge Base
Over 750 rules & best practices
for and
Get started for FREE
You are auditing:
Inactive IAM Console User
Risk level: Medium