# Ensure credentials unused for 90 days or greater are disabled

- Source: https://support.icompaas.com/support/solutions/articles/62000080698-ensure-credentials-unused-for-90-days-or-greater-are-disabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS Benchmark Level 1](https://support.icompaas.com/support/solutions/62000039484) › [CIS Control 16.9](https://support.icompaas.com/support/solutions/folders/62000066022)
- Last updated: 2026-06-04
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability: Level 1

Description:

AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 90 or greater days be removed or deactivated.

  

Rationale:

Disabling or removing unnecessary credentials will reduce the window of opportunity for credentials associated with a compromised or abandoned account to be used.

  

Impact:

By deleting or disabling the unused user credentials will protect your AWS resources against unapproved access.

  

Default Value:

By default AWS IAM will not disable credentials like password or Access keys at any moment.

  

Pre-Requisites:

-   Log in as an Administrator to perform the below steps
    
-   After auditing, if the found any user is not using credentials for 90 days or more then only perform the Implementation steps.
    

  

Remediation:

Test Plan:

Using AWS Console:

1.  Sign in to the AWS Management Console.
    
2.  Navigate to IAM service [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/).
    
3.  Click on the Credential report in the left navigation pane  
    
4.  Click on the download report option given, which lists all your account's users
    

5.  From the report, check the user, passwoord\_last\_used, and access\_key\_1\_last\_used\_date columns to check when the credentials were last used.
    
6.  If you notice any user is not using credentials from the past 90 days or more you need to disable the user. To do follow the Implementation steps.
    

  

Using AWS CLI:

Using the below command we can download the report 

aws iam get-credential-report

  

Implementation Steps:

Using AWS Console:

1.  Sign in to the AWS Management Console.
    
2.  Navigate to IAM service [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/).
    
3.  Click on Users in the left navigation pane  
    
4.  Click on the user that you want to take action and select the Security Credentials tab  
    
5.  In the Sign-in credentials tab, in the console sign-in section, click Enable console access.  
    
6.  Select Disable option and click on Apply.
    

  
  

7.  Go to the Access key section and find the key that’s status is Active and click on Deactivate option.  
    

  

Using AWS CLI: 

aws iam disable-user --user-name Myuser

Backout Plan:

If you want to revoke the changes you made do follow the steps 

1.  Sign in to the AWS Management Console.
    
2.  Navigate to IAM service [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/).
    
3.  Click on Users in the left navigation pane
    
4.  Click on the user that you want to take action and select the Security Credentials tab
    
5.  In the Sign-in credentials, section click on the Manage option next to the Console password
    
6.  Select Enable option next to Console password, set the password, and check the Require password reset checkbox and click on Apply.
    
7.  Go to the Access key section and click on Activate option
    

  

References:

-   [Security best practices in IAM - AWS Identity and Access Management](http://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) 
    
-   [AWS account root user - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html) 
    

  

CIS Controls:

16.9 Disable Dormant Accounts 

-   Automatically disable dormant accounts after a set period of inactivity.

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.