cyber.hendryadrian.com
Detection & Defense · wiz.io

How to Find and Remove Unneeded AWS Access Keys

· Original article ↗

Summary

Wiz outlines steps to remove unused AWS access keys and IAM users, replace static keys with SSO or IAM roles, and prevent new keys through an SCP. It says 31% of customer keys had been inactive for 90 days.

Key points

  • AWS access keys associated with IAM users do not expire and may persist in source code, logs, or backups, creating opportunities for later misuse.
  • Use AWS’s credentials report to identify inactive keys, keys unused for a chosen period, and IAM users without active credentials.
  • Wiz reports that 31% of the average cloud customer’s access keys had not been active in the past 90 days.
  • Disable root access keys after identifying their purpose; the article recommends avoiding routine root-user access.
  • Use SSO through a federated identity provider for human users and IAM roles with temporary credentials for compute resources.
  • Find keys on compute resources by scanning disks or examining CloudTrail logs for IP addresses associated with IAM user keys.
  • An SCP can deny creation of IAM users and access keys, but it also prevents key rotation and should be applied only after existing keys are removed.

Article Details

Defense Focus
Reduce exposure from long-lived AWS access keys and unnecessary IAM users, and prevent creation of new access keys and users.
Detection Methods
  • Use the credentials report to identify inactive keys, active keys with a last-used date of N/A, keys unused within a chosen period, and IAM users without active keys or a password.
  • Scan compute-resource disks for AWS access keys using a solution such as Wiz.
  • Examine CloudTrail logs for IP addresses associated with IAM user access keys.
  • Use `aws iam get-account-summary` to discover root access keys.
Data Sources
  • AWS credentials report
  • CloudTrail logs
  • Disk contents on AWS compute resources
Rule Types
  • Service Control Policy (SCP) denying `iam:CreateAccessKey` and `iam:CreateUser`
  • Infrastructure-as-Code auditing rules
Platforms
  • AWS
  • Wiz
Defensive Actions
  • Remove unused access keys, including keys that have not been used within an appropriately short review period.
  • Remove IAM users that have no credentials.
  • Disable root access keys where possible; determine their purpose and find an alternative for any that remain.
  • Transition human users to SSO through a federated identity provider.
  • Use IAM roles with temporary credentials for EC2 instances, Lambdas, and containers instead of static access keys.
  • Where appropriate, assign a compute resource an IAM role with the same privileges as the associated IAM user, then remove the static key.
  • Deploy an SCP to deny creation of new access keys and IAM users, but only after existing access keys have been removed because the policy also prevents key rotation.
  • Deploy Infrastructure-as-Code auditing rules to block access-key creation early in development.

Vendors

Amazon Web ServicesAccess keys associated with IAM users in AWS are unfortunately all too common. Wiz data indicates nearly every cloud customer has at least one. These keys are problematic because they never expire, so they end up in

Products

AWS SDKLambdas, and containers should be using IAM roles because they ensure credentials are temporary. The AWS SDK will check a number of places for credentials  such as environment variables, files on disk, andWizAccess keys associated with IAM users in AWS are unfortunately all too common. Wiz data indicates nearly every cloud customer has at least one. These keys are problematic because they never expire, so they end up in

Related Articles