IAM user does not have unused access keys older than 45 days
iam_user_accesskey_unused
IAM users are evaluated for active access keys whose last-used timestamp exceeds max_unused_access_keys_days (default 45). Users without access keys, or whose keys were used within this window, are reported separately.
Risk
Active yet unused keys expand the attack surface. If leaked, adversaries gain API access for data exfiltration, unauthorized changes, and resource abuse, harming confidentiality, integrity, and availability. Stale credentials also enable persistence and unexpected cost spikes.
prowler aws --checks iam_user_accesskey_unused
Recommendation
Disable or delete unused access keys promptly and prefer IAM roles with temporary credentials. Enforce least privilege, rotation, and time-bounded access. Monitor last-used metadata and automate deactivation of idle keys. Use federation/SSO to avoid long-lived user keys.
Remediation
aws iam update-access-key --user-name <USER_NAME> --access-key-id <ACCESS_KEY_ID> --status Inactive
- Sign in to the AWS console and open IAM
- Go to Users, select the affected user
- Open the Security credentials tab > Access keys
- For any key with Last used > 45 days, choose Deactivate (or Delete)
- Repeat for any additional unused keys over 45 days for the user
Source Code
Resource Type
AwsIamUser