IAM user has an access key that was never used

Severity: Low
Service: IAM
Check ID: USER_HAS_UNUSED_ACCESS_KEY

What this check finds

These users have access keys that have never been used. These access keys may have been communicated to the user insecurely, or otherwise may not be as well protected as they should.

Passing looks like: No unused IAM access keys.

How to fix it

Delete access keys that have never been used.

AWS CLI

aws iam delete-access-key --user-name USERNAME --access-key-id AKID

If the key was intended for use but hasn't been deployed, rotate it before use.

Names in capitals are placeholders for your own resource. Review a command before you run it.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to IAM user has an access key that was never used
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	1.10 Do not create access keys during initial setup for IAM users with a console password
PCI-DSS v4.0.1	8.2 User identification and related accounts are managed throughout their lifecycle
HIPAA Security Rule	164.312(a)(1) Access Control — Unique User Identification
SOC 2 — Trust Services Criteria	CC6.1 Identity Provisioning and Deprovisioning
NIST SP 800-53 Rev5 (Moderate)	AC-2 Account Management IA-5 Authenticator Management
NIST Cybersecurity Framework 2.0	PR.AA-01 Identities and credentials are managed
ISO/IEC 27001:2022 Annex A	A.5.16 Identity management A.5.17 Authentication information A.5.18 Access rights A.6.5 Responsibilities after termination or change of employment

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM checks

All IAM checks