Check provider logo

IAM user console access is disabled, used within the configured inactivity period, or never used

iam_user_console_access_unused

Severitymedium
Serviceiam
by Prowler
identity-access

IAM users with console access are evaluated by password_last_used. Inactivity beyond max_console_access_days (default 45) marks stale console access.

Users without console access are excluded.

Risk

Dormant console credentials stay valid and invite password spraying, credential stuffing, and breach reuse. Compromise yields interactive access for data discovery/exfiltration and unauthorized IAM or resource changes, degrading confidentiality and integrity, and risking availability.

Run this check with Prowler CLI

prowler aws --checks iam_user_console_access_unused

Run in Prowler Cloud

Recommendation

Remove or disable console passwords for users inactive beyond your window (e.g., 45 days). Prefer roles or federation over long-lived IAM users. Enforce least privilege, require MFA for remaining console users, and run periodic reviews and deprovisioning to prevent unused credentials.

Remediation

CLI

aws iam delete-login-profile --user-name <USER_NAME>

Native IaC
Terraform
Other
  1. Open the IAM console and go to Users
  2. Select the user
  3. Open the Security credentials tab
  4. Click Manage console access
  5. Select Disable console access and Save

Source Code

Resource Type

AwsIamUser

References