IAM users are evaluated for having two Active access keys simultaneously.
The check identifies users whose two access key slots are enabled at the same time.
Risk
Two active keys per user widen exposure and weaken credential governance.
- Any leaked key enables unauthorized API actions, risking data exfiltration and resource changes
- Rotation and response become error-prone, allowing attacker persistence if one key remains unnoticed
Run this check with Prowler CLI
prowler aws --checks iam_user_two_active_access_key
Recommendation
Maintain one Active access key per IAM user; permit only a brief overlap for rotation, then promptly deactivate and delete the old key. Prefer temporary credentials via roles/federation over long-lived keys. Apply least privilege, periodic rotation, and monitor for unused or aged keys.
Remediation
CLI
aws iam update-access-key --user-name <IAM_USER_NAME> --access-key-id <ACCESS_KEY_ID> --status Inactive
Native IaC
Terraform
Other
- In the AWS Console, go to IAM > Users
- Open the affected user and select the Security credentials tab
- In Access keys, find one of the two Active keys
- Click Actions > Deactivate on that key
- Verify only one key remains Active
Source Code
Resource Type
AwsIamUser
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/IAM/unnecessary-access-keys.html
- https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html
- https://support.icompaas.com/support/solutions/articles/62000233813-ensure-iam-users-have-two-active-access-keys
- https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAccessKeys.html