IAM Security and Audit

Two audit perspectives

The Credentials Report is an account-level CSV listing IAM users and the state of passwords, access keys, and MFA: when each was created, last used and rotated. Access Advisor shows service permissions granted to a principal and when each service was last accessed.

flowchart LR
  ACC["Account"] --> CR["Credentials Report<br/>CSV per user"]
  P["User or role"] --> AA["Access Advisor<br/>last accessed"]
  CR --> K["Old keys, no MFA<br/>fix or delete"]
  AA --> LP["Unused services<br/>remove permissions"]
  AN["IAM Access Analyzer<br/>external, unused access"] --> LP
  %% step ACC: The Credentials Report covers every IAM user in the account at once.
  %% step CR: It shows password age, key age and last use, and whether MFA is active.
  %% step P: Access Advisor looks at one principal at a time.
  %% step AA: It lists the services the principal may use and when it last used each one.
  %% step K: Rotate or delete keys that are old or unused, and enforce MFA.
  %% step LP: Remove permissions for services that were never used during the tracking period.
  %% step AN: Access Analyzer finds resources shared outside the account and unused access.

Access Advisor supplies review evidence but does not edit policies automatically. Interpret last-accessed data within its tracking period and consult the workload owner before removing access — a yearly job may simply not have run yet.

IAM Access Analyzer

Access Analyzer adds three checks:

• External access — finds S3 buckets, KMS keys, roles and other resources whose policies allow access from outside your account or organization.
• Unused access — reports unused roles, keys, passwords and permissions.
• Policy validation and generation — lints policies and can generate a least-privilege policy from CloudTrail activity.

Best-practice checklist

1. Root: MFA on, no access keys, used only for root-only tasks.
2. People: IAM Identity Center with MFA and short-lived credentials instead of IAM users.
3. Workloads: IAM roles (instance profiles, task roles, OIDC for CI) instead of stored keys.
4. Least privilege: start from narrow customer managed policies; review with Access Advisor and Access Analyzer.
5. Guardrails: in multi-account setups, SCPs block dangerous actions such as leaving the organization or disabling CloudTrail.
6. Rotate or delete unused access keys; a key unused for 90 days is a candidate for removal.
7. Audit: keep CloudTrail on in all Regions and alert on root sign-in and policy changes.

When a key leaks

Act in this order: deactivate the key, check CloudTrail for what it did, delete resources the attacker created, then delete the key and issue a new one to the owner if still needed. AWS may also open a support case or apply a quarantine policy when it detects a key on a public site.

Traps: believing Access Advisor removes permissions for you; deleting a key before checking CloudTrail; keeping long-lived keys "just in case".