User has not used access key for over 45 days

Severity: Low
Service: IAM
Check ID: USER_HAS_NOT_USED_ACCESS_KEY_FOR_MAX_DAYS

What this check finds

Access keys unused for over 45 days (CIS v5.0 §1.11) should be removed as they may have been lost but still grant access to the account.

Passing looks like: No idle IAM access keys.

How to fix it

Delete or deactivate stale access keys.

AWS CLI

aws iam delete-access-key --user-name USERNAME --access-key-id AKID

To deactivate first:

aws iam update-access-key --user-name USERNAME --access-key-id AKID --status Inactive

Names in capitals are placeholders for your own resource. Review a command before you run it.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to User has not used access key for over 45 days
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	1.11 Ensure credentials unused for 45 days or more are disabled
PCI-DSS v4.0.1	8.2 User identification and related accounts are managed throughout their lifecycle
HIPAA Security Rule	164.312(a)(1) Access Control — Unique User Identification
SOC 2 — Trust Services Criteria	CC6.1 Identity Provisioning and Deprovisioning
NIST SP 800-53 Rev5 (Moderate)	AC-2 Account Management IA-5 Authenticator Management
NIST Cybersecurity Framework 2.0	PR.AA-01 Identities and credentials are managed
ISO/IEC 27001:2022 Annex A	A.5.16 Identity management A.5.17 Authentication information A.5.18 Access rights A.6.5 Responsibilities after termination or change of employment

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM checks

All IAM checks