Do not setup access keys during initial user setup for all IAM users that have a console password

Rating 🛑 - High

Description

IAM users can have multiple credentials, for example passwords, or access keys.

Vulnerability

Access to the AWS account needs to be restricted to avoid the account being compromised. While having an access key is not strictly an issue, having access keys, and a console password would raise concerns on the multiple ways a user can gain access to the system, resulting in a potential breach if the credentials are not properly managed. Note that while AWS CIS v.1.20 is specifically checking access keys created with user created, AWS Security Info will check for any console user that also has access keys.

Remediation

To remediate this issue, either remove the console password, or remove the access keys.

References