IAM user does not have active access keys that have never been used
iam_user_no_setup_initial_access_key
IAM users with a console password and active access keys that have last_used as N/A are identified.
This highlights accounts where programmatic credentials exist but have never been exercised.
Risk
Active yet unused access keys expand the attack surface. If exposed, attackers gain programmatic access for unauthorized API calls, causing data exfiltration (confidentiality), unauthorized changes (integrity), and service disruption (availability). Dormant keys also bloat credential inventory, delaying detection and rotation.
prowler aws --checks iam_user_no_setup_initial_access_key
Recommendation
Apply least privilege to programmatic access:
- Do not provision access keys by default for console users
- Prefer IAM roles and temporary credentials
- Require justification and time-bounded key creation
- Regularly review usage and disable/delete unused keys
- Limit to one active key per user and enforce rotation with monitoring
Remediation
aws iam delete-access-key --user-name <example_resource_name> --access-key-id <example_resource_id>
- In the AWS Console, go to IAM > Users and select the user.
- Open the Security credentials tab.
- Under Access keys, find keys with Last used = N/A and Status = Active.
- Choose Deactivate or Delete for each such key.
- Save changes.
Source Code
Resource Type
AwsIamUser