cis-aws-foundations-2-11

name	cis-aws-foundations-2.11
description	Ensure credentials unused for 45 days or more are disabled
category	cis-iam
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","iam","credentials","unused-credentials","access-keys","password"]
cis_id	2.11
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-2.12","cis-aws-foundations-2.10"]
prerequisites	[]
severity_boost	{}

Ensure credentials unused for 45 days or more are disabled

Description

AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused for 45 days or more be deactivated or removed.

Rationale

Disabling or removing unused credentials reduces the window of opportunity for credentials associated with a compromised or abandoned account to be used.

Impact

Disabling or removing unused credentials reduces the window of opportunity for credentials associated with a compromised or abandoned account to be used.

Audit Procedure

Using AWS Console

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam
2. Click on Users
3. Click the Settings (gear) icon
4. Select Console last sign-in, Access key last used, and Access Key Id
5. Click on Confirm
6. Check and ensure that Console last sign-in is less than 45 days ago.

Note - - means the user has never logged in.

7. If credentials have not been used within 45 days, refer to remediation

Using AWS CLI

1. Generate and review the credential report:

aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d

2. Review the following fields:

• password_last_used
• access_key_1_last_used_date
• access_key_2_last_used_date

3. Identify any credentials unused for 45 days or more

Expected Result

All IAM user credentials (passwords and access keys) should show activity within the last 45 days. Any credentials unused for 45 days or more should be disabled or removed.

Remediation

Using AWS Console

Perform the following to deactivate or remove unused credentials:

1. Login to the AWS Management Console and open the IAM console
2. Click on the User