All checks
Medium
Unused IAM user credentials should be removed
Flags IAM users with a console password or active access key unused for 90 days or more; removing them narrows what an abandoned or compromised account exposes. One stale credential fails the user even beside one used today, and a never-used key counts from its creation, a never-used password from the user's.
- service
- IAM
- severity
- Medium
- scope
- evaluated once per account
How to fix it
In the console
IAM → Users → the user → Security credentials
With the AWS CLI
aws iam update-access-key --user-name <user-name> --access-key-id <access-key-id> --status InactiveSee which of your accounts this check is failing on.
Book a demo