IAM user has two access keys

Severity: Low
Service: IAM
Check ID: USER_HAS_TWO_ACCESS_KEYS

What this check finds

A user should only have one access key. The ability to have multiple access keys is only for when an access key is being rolled, and the old one should be removed.

Passing looks like: IAM users have at most one access key.

How to fix it

Identify the unused key and delete it.

AWS CLI

aws iam list-access-keys --user-name USERNAME

Then remove the old one:

aws iam delete-access-key --user-name USERNAME --access-key-id AKID

Names in capitals are placeholders for your own resource. Review a command before you run it.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to IAM user has two access keys
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	1.12 Ensure there is only one active access key for any single IAM user
SOC 2 — Trust Services Criteria	CC6.2 Role-Based Access Control
NIST SP 800-53 Rev5 (Moderate)	IA-5 Authenticator Management
NIST Cybersecurity Framework 2.0	PR.AA-01 Identities and credentials are managed
ISO/IEC 27001:2022 Annex A	A.5.17 Authentication information

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM checks

All IAM checks