# 1.11 Do Not Create Access Keys During Initial Setup for IAM Users with a Console Password (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000233101-1-11-do-not-create-access-keys-during-initial-setup-for-iam-users-with-a-console-password-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 1](https://support.icompaas.com/support/solutions/folders/62000169194) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Profile Applicability:** **Level 1** ## **Description:** When creating an IAM user, AWS provides the option to enable: - Programmatic access: Generates an access key (Access Key ID & Secret Access Key). - AWS Management Console access: Generates a console password for user login. To enforce least privilege and reduce security risks, access keys should not be created during initial user setup.  Instead, IAM users should explicitly request access keys only when needed. ## Rationale: - Reduces attack surface by preventing unnecessary credentials. - Encourages explicit intent when requesting programmatic access. - Prevents unused access keys from remaining active and unmonitored. - Reduces risk of credential leakage in logs, repositories, or shared environments. ## Impact: - Failure to restrict access key creation during IAM user setup increases the risk of credential exposure. - IAM users may receive access keys they do not need, increasing the potential for security misconfigurations. - Unused access keys may remain active indefinitely, creating an unmonitored attack vector. ## Default Value: By default, AWS does not create access keys for new IAM users. However, administrators can manually enable access keys during user creation. ## Pre-Requisites: 1. IAM Administrator Access: - Permissions required: iam:ListUsers, iam:ListAccessKeys, iam:DeleteAccessKey. 2. IAM Policy Enforcement: - Implement an IAM policy to restrict access key creation during user setup. 3. CloudTrail Monitoring: - Configure AWS CloudTrail to log IAM access key creation events. ## Remediation: ### Test Plan: ## Using AWS Console: 1. Login to the AWS Console as an IAM Administrator. 2. Navigate to IAM Console → Click Users.                           ![](https://support.icompaas.com/assets/kb/1e8cef2309c65368.png) 3. Identify users with both: - Password Age (indicating console access). - Access Key Age (indicating programmatic access).                        ![](https://support.icompaas.com/assets/kb/45f9fffcca43dee9.png)                      ![](https://support.icompaas.com/assets/kb/949aa45d2c1ad4f7.png) 4. Click on each user’s Security Credentials tab and compare: - User Creation Date vs Access Key Created Date. 5. If an IAM user's Access Key Creation Date matches their User Creation Date, they were issued an access key during setup. ## Using AWS Command Line : Generate a credential report: aws iam generate-credential-report Retrieve and process the credential report: aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,9,11,14,16 Identify unused access keys created during user setup: user,password\_enabled,access\_key\_1\_active,access\_key\_1\_last\_used\_date,access\_key\_2\_active,access\_key\_2\_last\_used\_date elise,false,true,2015-04-16T15:14:00+00:00,false,N/A brandon,true,true,N/A,false,N/A rakesh,false,false,N/A,false,N/A helene,false,true,2015-11-18T17:47:00+00:00,false,N/A paras,true,true,2016-08-28T12:04:00+00:00,true,2016-03-04T10:11:00+00:00 anitha,true,true,2016-06-08T11:43:00+00:00,true,N/A - If an IAM user has password\_enabled=true and access\_key\_last\_used\_date=N/A, the access key was never used and should be deleted. ## Implementation Steps: Step 1: Delete Unused Access Keys via Console 1. Login to AWS Console as an IAM Administrator. 2. Go to IAM Console → Click Users.                        ![](https://support.icompaas.com/assets/kb/cedbf8fd1edd8226.png) 3. Click on the IAM user’s name → Go to Security Credentials tab.                  ![](https://support.icompaas.com/assets/kb/4cb2e61f2e3449b6.png) 4. Identify unused access keys (those that match the User Creation Date but show no usage). 5. Click Delete (X) to remove unused access keys.                       ![](https://support.icompaas.com/assets/kb/c42b63909fcc6d60.png) Step 2: Delete Unused Access Keys via CLI - List all access keys for an IAM user: aws iam list-access-keys --user-name - Delete each unused access key: aws iam delete-access-key --user-name --access-key-id - Verify that all unused access keys are removed: aws iam list-access-keys --user-name - If an access key was mistakenly deleted, follow these steps:Regenerate a new access key for the affected IAM user: aws iam create-access-key --user-name 1. Securely store the new access key in a password manager. 2. Communicate the change to the IAM user. ## References: - AWS IAM Access Key Best Practices: [AWS Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) - AWS IAM Access Key Deletion CLI: [AWS CLI Docs](https://docs.aws.amazon.com/cli/latest/reference/iam/delete-access-key.html) - AWS IAM User Creation Guide: [AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html) ## CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

6.1

Establish an access granting process for new users.

CIS v8

6.2

Establish an access revocation process for unused credentials.

CIS v7

16.1

Maintain an inventory of authentication systems.

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.