# Ensure there is only one active access key available for any single IAM user

- Source: https://support.icompaas.com/support/solutions/articles/62000228293-ensure-there-is-only-one-active-access-key-available-for-any-single-iam-user
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources. You use IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources.

## **Rationale:**

Assigning IAM policy only through groups unifies permissions management to a single, flexible layer consistent with organizational functional roles. By unifying permissions management, the likelihood of excessive permissions is reduced.

## **Impact:**

IAM policy only through groups unifies permissions management.

## **Default Value:**

IAM user with access keys or password.

## **Pre-Requisite:**

Have IAM user with access keys.

## **Remediation:**

### **Test Plan:**

-   **AWS Console Process**
    

1.  Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/ "https://console.aws.amazon.com/iam/").
    
2.  In the left navigation pane select users.![](https://support.icompaas.com/assets/kb/3b67eb1fcb322df0.png)
    
3.  Select the user. 
4.  Click the Settings (gear) icon. ![](https://support.icompaas.com/assets/kb/2d72ab1b6c8245ef.png) 
5.  Select Console last sign-in, Access key last used, and Access Key Id, click on confirm.![](https://support.icompaas.com/assets/kb/13c29e21100a6dfe.png)
6.  Check and ensure that Console last sign-in is less than 45 days ago.
    
7.  Never means the user has never logged in.
    
8.  Check and ensure that Access key age is less than 45 days and that Access key last used does not say None. ![](https://support.icompaas.com/assets/kb/492523a227a37f5c.png) 
    
9.  If the user hasn't signed into the Console in the last 45 days or Access keys are over 45 days old refer to the implementation steps

**Using AWS CLI**

This example opens the returned report and outputs it to the pipeline as an array of text lines:

aws iam get-credential-report  
aws iam get-credential-report --query 'Content' --output text | base64 -d |   
cut -d, -f1,4,5,6,9,10,11,14,15,16 | grep -v '^<root\_account>'

Ensure unused credentials do not exist: 

-   For each user having password\_enabled set to TRUE , ensure password\_last\_used\_date is less than 45 days ago. 
    
-   When password\_enabled is set to TRUE and password\_last\_used is set to No\_Information , ensure password\_last\_changed is less than 45 days ago. 
    
-   For each user having an access\_key\_1\_active or access\_key\_2\_active to TRUE , ensure the corresponding access\_key\_n\_last\_used\_date is less than 45 days ago. 
    
-   When a user having an access\_key\_x\_active (where x is 1 or 2) to TRUE and corresponding access\_key\_x\_last\_used\_date is set to N/A', ensure access\_key\_x\_last\_rotated\` is less than 45 days ago.
    

  

### **Implementation Plan**

-   **AWS Console Process**
    

**Perform the following to manage Unused Password (IAM user console access)**

1.  Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/ "https://console.aws.amazon.com/iam/").
    
2.  In the left navigation pane select users.
    
3.  Click on desired user.
    
4.  Click security credentials.![](https://support.icompaas.com/assets/kb/bdff2265c12d6bad.png)
    
5.  In section Sign-in credentials, Console password click Manage.![](https://support.icompaas.com/assets/kb/f370ef2faa263ef0.png)
    
6.  Under Console Access select Disable and click Apply.![](https://support.icompaas.com/assets/kb/4b8614f2b9edade1.png)
    

  

**Perform the following to deactivate Access Keys:**

1.  Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/ "https://console.aws.amazon.com/iam/").
    
2.  In the left navigation pane select users.
    
3.  Click on the user.
    
4.  Click on Security Credentials.
    
5.  Select any access keys that are over 45 days old and that have been used and. 
    
6.  Click on Make Inactive. ![](https://support.icompaas.com/assets/kb/52da836053897788.png) 
    
7.  Select any access keys that are over 45 days old and that have not been used and click the X to Delete.

  

**Using AWS CLI**

1.  Access keys that are over 45 days old and that have not been used can be deleted.
    
2.  The following `delete-access-key` command deletes the specified access key (access key ID and secret access key) for the IAM user named `Bob`:
    
    aws iam delete-access-key --access-key-id AKIDPMS9RO4H3FEXAMPLE --user-name Bob
    
    ### **Backout Plan:**
    
    1.  Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/ "https://console.aws.amazon.com/iam/").
        
    2.  In the left navigation pane select users.
        
    3.  Click on desired user. 
        
    4.  Click security credentials  ![](https://support.icompaas.com/assets/kb/b9ee98098882d4ab.png)  
        
    5.  Scroll down in Access keys Click on make active to activate the access key. ![](https://support.icompaas.com/assets/kb/3e6281feceb3efdb.png) 
        
    6.  In section Sign-in credentials, Console password click Manage. ![](https://support.icompaas.com/assets/kb/9f4f0fc58d9d2bed.png) 
        
    7.  Select enable and click on apply.![](https://support.icompaas.com/assets/kb/59e1b1b32bc2c979.png)
        
    
      
    
    **Using AWS CLI**
    
    **No CLI commands for this implementation plan**

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.