User account with multiple access keys remediation

Triage and Remediation

Prevention
Cause
Remediation

How to Prevent

Using Console

To prevent user accounts from having multiple access keys in AWS IAM using the AWS Management Console, follow these steps:

Navigate to IAM Dashboard:
- Sign in to the AWS Management Console.
- Open the IAM (Identity and Access Management) dashboard by selecting “IAM” from the services menu.
Access User Details:
- In the IAM dashboard, select “Users” from the left-hand navigation pane.
- Click on the username of the user you want to manage.
Review Access Keys:
- In the user details page, select the “Security credentials” tab.
- Under the “Access keys” section, review the list of access keys associated with the user.
Enforce Single Access Key Policy:
- Ensure that each user has only one active access key.
- If a user has multiple access keys, consider implementing a policy or standard operating procedure (SOP) that restricts the creation of multiple access keys per user.
- Educate users and administrators on the importance of maintaining a single access key for security and management purposes.

By following these steps, you can help prevent the misconfiguration of user accounts having multiple access keys in AWS IAM using the AWS Management Console.

Using CLI

To prevent a user account from having multiple access keys in AWS IAM using the AWS CLI, you can follow these steps:

Create a New IAM User Without Access Keys: Ensure that when you create a new IAM user, you do not create multiple access keys for them. Use the following command to create a new IAM user without any access keys:
aws iam create-user --user-name NewUserName
Attach Policies to the User: Attach the necessary policies to the user without creating multiple access keys. For example, to attach the AmazonS3ReadOnlyAccess policy:
aws iam attach-user-policy --user-name NewUserName --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
Monitor and List Access Keys: Regularly monitor and list the access keys for each user to ensure they do not have multiple access keys. Use the following command to list access keys for a specific user:
aws iam list-access-keys --user-name ExistingUserName

Enforce Policy to Restrict Multiple Access Keys: Create and attach an IAM policy that restricts users from creating multiple access keys. This can be done by defining a policy that denies the iam:CreateAccessKey action if the user already has an active access key. Here is an example of such a policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "iam:CreateAccessKey",
      "Resource": "arn:aws:iam::*:user/${aws:username}",
      "Condition": {
        "NumericGreaterThan": {
          "aws:RequestTag/AccessKeyCount": "1"
        }
      }
    }
  ]
}

Attach this policy to the users or groups as needed:

aws iam put-user-policy --user-name ExistingUserName --policy-name RestrictMultipleAccessKeys --policy-document file://policy.json

By following these steps, you can prevent IAM users from having multiple access keys using the AWS CLI.

Using Python

To prevent a user account from having multiple access keys in IAM using Python scripts, you can follow these steps:

Set Up AWS SDK (Boto3) for Python:
- Ensure you have the AWS SDK for Python (Boto3) installed. You can install it using pip if you haven’t already:
  pip install boto3

Create a Python Script to List Access Keys:

Write a Python script to list all access keys for a given IAM user. This will help you identify if a user has multiple access keys.

import boto3

# Initialize a session using Amazon IAM
session = boto3.Session(profile_name='your_profile_name')
iam_client = session.client('iam')

# Function to list access keys for a user
def list_access_keys(user_name):
    response = iam_client.list_access_keys(UserName=user_name)
    return response['AccessKeyMetadata']

# Example usage
user_name = 'your_iam_user_name'
access_keys = list_access_keys(user_name)
print(f"Access keys for user {user_name}: {access_keys}")

Check for Multiple Access Keys:

Extend the script to check if a user has more than one access key and print a warning message if they do.

def check_multiple_access_keys(user_name):
    access_keys = list_access_keys(user_name)
    if len(access_keys) > 1:
        print(f"Warning: User {user_name} has multiple access keys.")
    else:
        print(f"User {user_name} has a single access key or none.")

# Example usage
check_multiple_access_keys(user_name)

Automate the Check for All Users:

Automate the process to check all IAM users in your account and ensure none of them have multiple access keys.

def list_all_users():
    response = iam_client.list_users()
    return response['Users']

def check_all_users_for_multiple_access_keys():
    users = list_all_users()
    for user in users:
        user_name = user['UserName']
        check_multiple_access_keys(user_name)

# Example usage
check_all_users_for_multiple_access_keys()

By following these steps, you can create a Python script that checks for multiple access keys for IAM users and helps prevent this misconfiguration. This script can be run periodically or integrated into your CI/CD pipeline to ensure compliance.

Check Cause

Using Console

Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
In the navigation pane, choose “Users”.
In the “User Name” list, choose the name of the intended user.
In the “User Summary” section, choose the “Security Credentials” tab.
Under “Access Keys”, check the number of access keys assigned to the user. If there are more than one access keys, then the user account has multiple access keys.

Using CLI

Install and configure AWS CLI: Before you can start, you need to install AWS CLI on your local machine. You can do this by using the command pip install awscli. After installation, you need to configure it using aws configure command. You will be prompted to provide your AWS Access Key ID, Secret Access Key, Default region name, and Default output format.
List IAM users: Use the following command to list all the IAM users in your AWS account:
aws iam list-users
This command will return a list of all IAM users in your AWS account.
List access keys for each user: For each user, you need to check the number of access keys. You can do this by using the following command:
aws iam list-access-keys --user-name <username>
Replace <username> with the name of the IAM user. This command will return a list of all access keys associated with the specified IAM user.
Check the number of access keys: If the number of access keys for a user is more than one, then it is a misconfiguration. You can check this by counting the number of access keys returned by the previous command. If the count is more than one, then the user has multiple access keys.

Using Python

First, you need to install the AWS SDK for Python (Boto3) if you haven’t done so already. You can install it using pip:

pip install boto3

Import the necessary modules and create a session using your AWS credentials:

import boto3

session = boto3.Session(
    aws_access_key_id='YOUR_ACCESS_KEY',
    aws_secret_access_key='YOUR_SECRET_KEY',
    region_name='us-west-2'
)

Now, create a client for IAM and list all the users:

iam = session.client('iam')
users = iam.list_users()['Users']

For each user, list the access keys and check if there are more than one. If there are, print a warning:

for user in users:
    access_keys = iam.list_access_keys(UserName=user['UserName'])['AccessKeyMetadata']
    if len(access_keys) > 1:
        print(f"Warning: User {user['UserName']} has multiple access keys.")

This script will print a warning for each user that has more than one access key. Note that you need to replace ‘YOUR_ACCESS_KEY’ and ‘YOUR_SECRET_KEY’ with your actual AWS credentials.

Remediation

Using Console

Here are the step-by-step instructions to remediate the misconfiguration “User Account Should Not Have Multiple Access Keys” for AWS using the AWS console:

Log in to the AWS Management Console with your AWS account credentials.
Go to the “IAM” dashboard by searching “IAM” in the AWS services search bar.
In the left navigation pane, click on “Users”.
Select the user account that has multiple access keys.
Click on the “Security credentials” tab.
In the “Access keys” section, you will see all the access keys associated with the user account.
Identify the access keys that are not being used or are no longer required.
Click on the “Delete” button next to the access keys that need to be deleted.
In the confirmation dialog box, click on “Yes, Delete” to confirm the deletion of the access key.
Repeat steps 7-9 for all the access keys that need to be deleted.
Once all the unnecessary access keys have been deleted, click on the “Create access key” button to create a new access key.
In the “Create access key” dialog box, click on the “Download .csv” button to download the new access key credentials.
Store the new access key credentials securely.

By following these steps, you will remediate the misconfiguration “User Account Should Not Have Multiple Access Keys” for AWS using the AWS console.

Using CLI

To remediate the misconfiguration “User Account Should Not Have Multiple Access Keys” for AWS using AWS CLI, you can follow the below steps:Step 1: List all the access keys for the user account using the following command:

aws iam list-access-keys --user-name <user-name>

Note: Replace <user-name> with the actual user name.Step 2: Identify the unused access keys that need to be deleted.Step 3: Delete the unused access keys using the following command:

aws iam delete-access-key --access-key-id <access-key-id> --user-name <user-name>

Note: Replace <access-key-id> with the actual access key ID and <user-name> with the actual user name.Step 4: Verify that the unused access keys have been deleted by running the command in step 1 again.Repeat steps 2-4 for all the unused access keys until there is only one access key left for the user account.Once you have ensured that there is only one access key for the user account, the misconfiguration “User Account Should Not Have Multiple Access Keys” has been remediated.

Using Python

To remediate the issue of having multiple access keys for a user account in AWS, you can use the following Python script:

import boto3

# Set the name of the user whose access keys need to be checked
user_name = 'your_username_here'

# Create a connection to the IAM service
iam = boto3.client('iam')

# Get all the access keys for the user
access_keys = iam.list_access_keys(UserName=user_name)['AccessKeyMetadata']

# If the user has more than one access key, delete all but the most recent one
if len(access_keys) > 1:
    # Sort the access keys by creation date, with the most recent one first
    sorted_keys = sorted(access_keys, key=lambda k: k['CreateDate'], reverse=True)
    # Delete all but the most recent access key
    for key in sorted_keys[1:]:
        iam.delete_access_key(UserName=user_name, AccessKeyId=key['AccessKeyId'])

Explanation:

The first step is to import the boto3 library, which is the AWS SDK for Python.
Next, we set the name of the user whose access keys need to be checked. Replace ‘your_username_here’ with the actual username.
We create a connection to the IAM service using the boto3.client method.
We use the list_access_keys method to get all the access keys for the user.
If the user has more than one access key, we sort the access keys by creation date, with the most recent one first.
We then delete all but the most recent access key using the delete_access_key method.

Note: This script assumes that you have AWS credentials set up on the machine where you are running the script. If not, you will need to provide credentials in the script or use another method for authentication.

Using Terraform

resource "aws_iam_user" "this" {
  name = "IAM_USER_NAME" # replace with the IAM user name that should have only one access key
}

# Keep exactly ONE access key resource for this user in Terraform.
# Remove any additional aws_iam_access_key resources for this user from your configuration.
resource "aws_iam_access_key" "primary" {
  user = aws_iam_user.this.name

  # Optionally, tag this key to make it clear it's the primary/only key.
  # tags = {
  #   Name = "PRIMARY_ACCESS_KEY"
  # }
}

To mirror the CLI remediation with Terraform:

Ensure that you have at most one aws_iam_access_key resource referencing a given user in your configuration; delete any extra aws_iam_access_key blocks or references to this user and run terraform apply. Terraform will then issue iam:DeleteAccessKey for the removed resources.
Any access keys that were created outside Terraform (console/CLI) are not visible to Terraform and cannot be selectively deactivated or deleted via Terraform; you must follow the AWS Console/CLI steps you listed (list-access-keys, get-access-key-last-used, update-access-key to Inactive, then delete-access-key after monitoring).

Deleting an access key via Terraform (by removing its aws_iam_access_key resource) forces immediate and irreversible loss of access for any workload using that key, exactly as with the CLI delete-access-key. Deactivation-before-deletion is not currently modeled as a separate Terraform operation; you must do that manually with the AWS CLI if you need a probation period.Verification:
terraform plan should show aws_iam_access_key resources for this user reduced to one +/~ (create/update) and any removed access keys as -/+ or - (destroy), with no other access keys for the same user remaining in the plan.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

User account with multiple access keys remediation

Triage and Remediation

How to Prevent

Check Cause

Remediation

​Triage and Remediation

​How to Prevent

​Check Cause

​Remediation

​

Triage and Remediation

How to Prevent

Check Cause

Remediation