Detections
Analytics

1.13 Ensure there is only one active access key available for any single IAM user

Information

Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)

Rationale:

Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API. One of the best ways to protect your account is to not allow users to have multiple access keys.

Solution

From Console:

Sign in to the AWS Management Console and navigate to IAM dashboard at https://console.aws.amazon.com/iam/.

In the left navigation panel, choose Users.

Click on the IAM user name that you want to examine.

On the IAM user configuration page, select Security Credentials tab.

In Access Keys section, choose one access key that is less than 90 days old. This should be the only active key used by this IAM user to access AWS resources programmatically. Test your application(s) to make sure that the chosen access key is working.

In the same Access Keys section, identify your non-operational access keys (other than the chosen one) and deactivate it by clicking the Make Inactive link.

If you receive the Change Key Status confirmation box, click Deactivate to switch off the selected key.

Repeat steps no. 3 - 7 for each IAM user in your AWS account.

From Command Line:

Using the IAM user and access key information provided in the Audit CLI, choose one access key that is less than 90 days old. This should be the only active key used by this IAM user to access AWS resources programmatically. Test your application(s) to make sure that the chosen access key is working.

Run the update-access-key command below using the IAM user name and the non-operational access key IDs to deactivate the unnecessary key(s). Refer to the Audit section to identify the unnecessary access key ID for the selected IAM user

Note - the command does not return any output:

aws iam update-access-key --access-key-id <access-key-id> --status Inactive --user-name <user-name>

To confirm that the selected access key pair has been successfully deactivated run the list-access-keys audit command again for that IAM User:

aws iam list-access-keys --user-name <user-name>

The command output should expose the metadata for each access key associated with the IAM user. If the non-operational key pair(s) Status is set to Inactive, the key has been successfully deactivated and the IAM user access configuration adheres now to this recommendation.

Repeat steps no. 1 - 3 for each IAM user in your AWS account.

See Also

https://workbench.cisecurity.org/benchmarks/14207

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2, CSCv7|4

Plugin: amazon_aws

Control ID: 13817b6e684fcb5614faa13607f82c1ad8e8e26b7e5e4adc80bfe136ab3896bc