IAM User Approaching User Access Key Limit

AWS IAM Users have a per user limit for Access Keys, hitting this limit interferes with the ability to cycle Access Keys and contributes to the overall acount Access Key Limit

Details ¶

AWS IAM Users are designed for use by natural persons, providing them with console access via usernames & passwords and Access Keys for use with the AWS CLI (Command Line Interface) and SDKs (Software Development Kits). Access Keys consist of an Access Key ID and an Access Key Secret. Together, these two components offer sufficient identification for using the AWS CLI and SDKs.

As the Key ID and Key Secret is all that’s required to authorise access to AWS APIs as that user, it is critical to ensure that the least number of Access Keys are present and that they are securely managed. If both the Access Key ID and Secret are compromised, the IAM User is compromised and potentially the AWS Account depending on the permissions assigned to the IAM User. Ideally, IAM Users should have only one Access Key issued and active to simplify management and monitoring of Access Key usage. Multiple Access Keys for a single user create additional tracking and monitoring obligations and contribute unnecessarily to the overall number of Access Keys operational in an AWS account.

Additionally, AWS accounts have a maximum number of Access Keys as well as a limit on the number of Access Keys available per user. IAM Users should minimise their issued keys to avoid reaching these limits. If the limit is hit, new Access Keys cannot be issued, interfering with most Access Key rotation processes. Therefore, it’s important to leave room within your Access Key quota for both the IAM User quota and AWS Account-wide quota to ensure effective management and monitoring of Access Keys.

Remediation ¶

To address this issue, begin by identifying IAM Users with multiple Access Keys and consolidate their Access Key usage, ideally to a single Access Key. Monitor the Access Keys assigned to each user to determine if your AWS Account is nearing the quota limit. Taking action to consolidate keys ahead of time can prevent any constraints from the Access Key limits.

The total number of Access Keys per IAM User is fixed at two Access Keys hence there is no way to adjust these quotas, hence management is the only option.