User has not logged in for over 45 days

Severity: Medium
Service: IAM
Check ID: USER_HAS_NOT_LOGGED_IN_FOR_OVER_MAX_DAYS

What this check finds

The user has not used their password login for over 45 days (CIS v5.0 §1.11). The password login should be removed from this user, or the user entirely.

Passing looks like: No stale IAM user logins.

How to fix it

Remove console access from inactive users.

AWS CLI

aws iam delete-login-profile --user-name USERNAME

If the user also has no active access keys, consider deleting the user entirely:
```
aws iam delete-user --user-name USERNAME
```

Names in capitals are placeholders for your own resource. Review a command before you run it.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to User has not logged in for over 45 days
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	1.11 Ensure credentials unused for 45 days or more are disabled
PCI-DSS v4.0.1	8.2 User identification and related accounts are managed throughout their lifecycle
HIPAA Security Rule	164.312(a)(1) Access Control — Unique User Identification
SOC 2 — Trust Services Criteria	CC6.1 Identity Provisioning and Deprovisioning
NIST SP 800-53 Rev5 (Moderate)	AC-2 Account Management
NIST Cybersecurity Framework 2.0	PR.AA-01 Identities and credentials are managed
ISO/IEC 27001:2022 Annex A	A.5.16 Identity management A.5.18 Access rights A.6.5 Responsibilities after termination or change of employment

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM checks

All IAM checks