Pipeline: 1.12 Ensure credentials unused for 45 days or greater are disabled

Description

AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.

Disabling or removing unnecessary credentials will reduce the window of opportunity for credentials associated with a compromised or abandoned account to be used.

Remediation

From Console:

Perform the following to manage Unused Password (IAM user console access)

Login to the AWS Management Console:
Click Services.
Click IAM.
Click on Users.
Click on Security Credentials.
Select user whose Console last sign-in is greater than 45 days.
Click Security credentials.
In section Sign-incredentials, Console password click Manage.
Under Console Access select Disable.
Click Apply

Perform the following to deactivate Access Keys:

Login to the AWS Management Console:
Click Services.
Click IAM.
Click on Users.
Click on Security Credentials.
Select any access keys that are over 45 days old and that have been used and

Click on Make inactive.

Select any access keys that are over 45 days old and that have not been used and

Click the X to Delete.

Run the pipeline

To run this pipeline from your terminal:

flowpipe pipeline run aws_cis.pipeline.cis_v300_1_12

Use this pipeline

To call this pipeline from your pipeline, use a step:

step "pipeline" "step_name" {
  pipeline = aws_cis.pipeline.cis_v300_1_12  
}

Params

Name	Type	Required	Description	Default
database	connection.steampipe	Yes	Database connection string.	`connection.steampipe.default`
notifier	notifier	Yes	The name of the notifier to use for sending notification messages.	`notifier.default`
notification_level	string	Yes	The verbosity level of notification messages to send. Valid options are 'verbose', 'info', 'error'.	`info`
approvers	list(notifier)	Yes	List of notifiers to be used for obtaining action/approval decisions.	`notifier.default`

Outputs

This pipeline has no outputs.