IAM user console access is disabled or recently used

Check ID: iam_user_console_access_unused
Provider: AWS
Service: iam
Severity: MEDIUM
Categories: identity-access
Resource type: AwsIamUser

What this check verifies

IAM users with console access are evaluated by password_last_used. Inactivity beyond max_console_access_days (default 45) marks stale console access. Users without console access are excluded.

Risk

Dormant console credentials stay valid and invite password spraying, credential stuffing, and breach reuse. Compromise yields interactive access for data discovery/exfiltration and unauthorized IAM or resource changes, degrading confidentiality and integrity, and risking availability.

Recommendation

Remove or disable console passwords for users inactive beyond your window (e.g., 45 days). Prefer roles or federation over long-lived IAM users. Enforce least privilege, require MFA for remaining console users, and run periodic reviews and deprovisioning to prevent unused credentials.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam delete-login-profile —user-name <USER_NAME>

# IAM user with console access disabled by not creating a login profile
resource "aws_iam_user" "<example_resource_name>" {
  name = "<example_resource_name>"
  # Critical: Do not define aws_iam_user_login_profile for this user -> no console access
}

# CloudFormation: IAM user without console access
Resources:
  <example_resource_name>:
    Type: AWS::IAM::User
    Properties:
      UserName: <example_resource_name>
      # Critical: No LoginProfile property -> disables console access for the user

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_user_console_access_unused. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires