IAM role has not been used for over 365 days

Severity: Low
Service: IAM
Check ID: IAM_ROLE_STALE

What this check finds

Stale IAM roles that are no longer in use still grant permissions and can be assumed by anyone with the right trust policy. Removing unused roles reduces the attack surface and accidental privilege escalation paths.

Passing looks like: No stale IAM roles.

How to fix it

Review the role and delete it if no longer needed.

AWS CLI

Detach its policies first:

aws iam detach-role-policy --role-name ROLE_NAME --policy-arn POLICY_ARN

Then delete the role:

aws iam delete-role --role-name ROLE_NAME

If uncertain, disable by removing all attached policies before deleting.

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

IAM → Roles → select role → check Last activity → Delete.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to IAM role has not been used for over 365 days
Framework	Controls
PCI-DSS v4.0.1	7.3 Access to system components and data is managed via an access control system
HIPAA Security Rule	164.308(a)(3) Workforce Security — Access Authorization
NIST SP 800-53 Rev5 (Moderate)	AC-2 Account Management
NIST Cybersecurity Framework 2.0	PR.AA-01 Identities and credentials are managed
ISO/IEC 27001:2022 Annex A	A.5.16 Identity management A.5.18 Access rights A.6.5 Responsibilities after termination or change of employment

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM checks

All IAM checks