User Account Should Not Have Multiple Access Keys
More Info:
Multiple access keys for the same user should be avoided. There should be just 1 access key per user account.Risk Level
MediumAddress
SecurityCompliance Standards
CISAWS, CBP, HITRUSTTriage and Remediation
How to Prevent
Using Console
Using Console
To prevent user accounts from having multiple access keys in AWS IAM using the AWS Management Console, follow these steps:
-
Navigate to IAM Dashboard:
- Sign in to the AWS Management Console.
- Open the IAM (Identity and Access Management) dashboard by selecting “IAM” from the services menu.
-
Access User Details:
- In the IAM dashboard, select “Users” from the left-hand navigation pane.
- Click on the username of the user you want to manage.
-
Review Access Keys:
- In the user details page, select the “Security credentials” tab.
- Under the “Access keys” section, review the list of access keys associated with the user.
-
Enforce Single Access Key Policy:
- Ensure that each user has only one active access key.
- If a user has multiple access keys, consider implementing a policy or standard operating procedure (SOP) that restricts the creation of multiple access keys per user.
- Educate users and administrators on the importance of maintaining a single access key for security and management purposes.
Using CLI
Using CLI
To prevent a user account from having multiple access keys in AWS IAM using the AWS CLI, you can follow these steps:
-
Create a New IAM User Without Access Keys:
Ensure that when you create a new IAM user, you do not create multiple access keys for them. Use the following command to create a new IAM user without any access keys:
-
Attach Policies to the User:
Attach the necessary policies to the user without creating multiple access keys. For example, to attach the
AmazonS3ReadOnlyAccesspolicy: -
Monitor and List Access Keys:
Regularly monitor and list the access keys for each user to ensure they do not have multiple access keys. Use the following command to list access keys for a specific user:
-
Enforce Policy to Restrict Multiple Access Keys:
Create and attach an IAM policy that restricts users from creating multiple access keys. This can be done by defining a policy that denies the
iam:CreateAccessKeyaction if the user already has an active access key. Here is an example of such a policy:Attach this policy to the users or groups as needed:
Using Python
Using Python
To prevent a user account from having multiple access keys in IAM using Python scripts, you can follow these steps:
-
Set Up AWS SDK (Boto3) for Python:
- Ensure you have the AWS SDK for Python (Boto3) installed. You can install it using pip if you haven’t already:
- Ensure you have the AWS SDK for Python (Boto3) installed. You can install it using pip if you haven’t already:
-
Create a Python Script to List Access Keys:
- Write a Python script to list all access keys for a given IAM user. This will help you identify if a user has multiple access keys.
-
Check for Multiple Access Keys:
- Extend the script to check if a user has more than one access key and print a warning message if they do.
-
Automate the Check for All Users:
- Automate the process to check all IAM users in your account and ensure none of them have multiple access keys.