IAM user has at most one active access key

Check ID: iam_user_two_active_access_key
Provider: AWS
Service: iam
Severity: MEDIUM
Categories: identity-access, secrets
Resource type: AwsIamUser

What this check verifies

IAM users are evaluated for having two Active access keys simultaneously. The check identifies users whose two access key slots are enabled at the same time.

Risk

Two active keys per user widen exposure and weaken credential governance.

Any leaked key enables unauthorized API actions, risking data exfiltration and resource changes
Rotation and response become error-prone, allowing attacker persistence if one key remains unnoticed

Recommendation

Maintain one Active access key per IAM user; permit only a brief overlap for rotation, then promptly deactivate and delete the old key. Prefer temporary credentials via roles/federation over long-lived keys. Apply least privilege, periodic rotation, and monitor for unused or aged keys.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam update-access-key —user-name <IAM_USER_NAME> —access-key-id <ACCESS_KEY_ID> —status Inactive

# Deactivate one IAM access key so the user has at most one active key
resource "aws_iam_access_key" "<example_resource_name>" {
  user   = "<example_resource_name>"
  status = "Inactive"  # Critical: deactivates this key to avoid 2 active keys
}

# CloudFormation: set one IAM access key to Inactive to ensure only one active key
Resources:
  <example_resource_name>:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: <example_resource_name>
      Status: Inactive  # Critical: deactivates this key so the user doesn't have 2 active keys

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_user_two_active_access_key. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires