IAM User Has Inactive Access Keys

AWS IAM Users should not have long-term inactive Access Keys

Details ¶

AWS IAM users are intended for use by individuals, allowing them to issue Access Keys that can be used by programmatic tools such as the AWS CLI and software development kits. These Access Keys serve as an alternative to a username and password, providing a way for technical systems to assume a user’s identity without requiring a full authentication flow. As such, Access Keys can provide full access to an account based on the user’s specific set of permissions.

There are two states of Access Keys: active and inactive. Active Access Keys can communicate with AWS APIs, while inactive keys exist but cannot perform any actions when attempting to contact AWS APIs. Inactive Access Keys will be recognised by the API but will not have their requests processed.

Having inactive Access Keys for an extended period poses a security risk. While these keys are not currently functional, they can be reactivated at any time, restoring their full permissions. This creates a false sense of security, as they are just a configuration change away from being fully operational again.

The activation of Access Keys typically indicates a transitional process, often for replacing or testing keys. Neither of these scenarios necessitates keeping Access Keys in a long-term inactive state. Therefore, any deactivated key should be expected to be reactivated shortly or permanently deleted.

Remediation ¶

Since inactive keys are not functional, it is usually not a significant organisational threat to delete them. It may be worth investigating Access Keys that have been inactive for a long time period. However, as a general rule, since deactivated keys are not in use, they can be safely decommissioned by deleting them rather than merely leaving them in a deactivated state.

SkySiege Cloud Assessment will automatically find all inactive Access Keys in your AWS Accounts and for Organisations provides the automated clean up solutions to remove these keys as part of our long term support. Get a Cloud Assessment booked in now to determine how many inactive keys you have across your organisation: