IAM user has no active access keys that have never been used

Check ID: iam_user_no_setup_initial_access_key
Provider: AWS
Service: iam
Severity: MEDIUM
Categories: identity-access, secrets
Resource type: AwsIamUser

What this check verifies

IAM users with a console password and active access keys that have last_used as N/A are identified. This highlights accounts where programmatic credentials exist but have never been exercised.

Risk

Active yet unused access keys expand the attack surface. If exposed, attackers gain programmatic access for unauthorized API calls, causing data exfiltration (confidentiality), unauthorized changes (integrity), and service disruption (availability). Dormant keys also bloat credential inventory, delaying detection and rotation.

Recommendation

Apply least privilege to programmatic access:

Do not provision access keys by default for console users
Prefer IAM roles and temporary credentials
Require justification and time-bounded key creation
Regularly review usage and disable/delete unused keys
Limit to one active key per user and enforce rotation with monitoring

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam delete-access-key —user-name <example_resource_name> —access-key-id <example_resource_id>

# Ensure IAM access key is not active
resource "aws_iam_access_key" "<example_resource_name>" {
  user   = "<example_resource_name>"
  status = "Inactive"  # Critical: disables the key so it isn't active and cannot be flagged as never used
}

# CloudFormation: ensure IAM access key is not active
Resources:
  AccessKey:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: "<example_resource_name>"
      Status: Inactive  # Critical: disables the key so it isn't active and cannot be flagged as never used

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_user_no_setup_initial_access_key. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires