Description

Ensure that IAM users who have a console password but have not signed in to the AWS Management Console for more than 45 days have their console access disabled. Users without a console password, and users whose console password has never been used, are not evaluated.

Rationale

Console passwords that are no longer used remain valid and can be targeted by password spraying, credential stuffing and reuse of passwords leaked in other breaches. Because nobody actively uses these accounts, a compromise is less likely to be noticed. An attacker who signs in gets interactive access to explore and take data and to change IAM or other resources. Removing console access from inactive users, and preferring federated access or roles over long-lived IAM users, removes this unused attack path.

Impact

  • Removes dormant console passwords that could be used without anyone noticing

  • The affected user can no longer sign in to the AWS Management Console; their access keys, if any, are not affected

  • If the user needs console access again, an administrator must create a new password

Default Value

A newly created IAM user has no console password unless one is set when the user is created. AWS does not disable unused console passwords automatically.

Pre-Requisites

  • IAM permissions: iam:ListUsers, iam:GetLoginProfile, iam:DeleteLoginProfile and iam:CreateLoginProfile

  • Confirmation from each user's owner that console access is no longer needed

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Users in the left menu.

  3. Review the Console last sign-in column for each user.

  4. If a user has console access and last signed in more than 45 days ago, follow the implementation steps.

CLI:

List all IAM users with the date their password was last used:

aws iam list-users --query "Users[].[UserName,PasswordLastUsed]" --output table

For each user with an old date, confirm that a console password still exists (a NoSuchEntity error means the user has no console password):

aws iam get-login-profile --user-name <USER_NAME>

A user fails if they have a console password and PasswordLastUsed is more than 45 days ago. Users whose password has never been used (no PasswordLastUsed value) are not evaluated.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Users in the left menu.

  3. Select the affected user and open the Security credentials tab.

  4. In the Console sign-in section, choose Manage console access.

  5. Select Disable and choose Apply.

  6. Repeat for each affected IAM user.

CLI:

Remove the console password of the user:

aws iam delete-login-profile --user-name <USER_NAME>

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console, select Users in the left menu and select the user.

  3. On the Security credentials tab, choose Manage console access.

  4. Select Enable, set a new password and require the user to reset it at next sign-in.

  5. Choose Apply and share the new password with the user securely.

CLI:

aws iam create-login-profile --user-name <USER_NAME> --password <TEMPORARY_PASSWORD> --password-reset-required

Note: the previous password cannot be restored, so a new one must be issued. Re-enabling console access for an inactive user restores the dormant credential risk.

Reference