User Account Service Should Have Activity

More Info:

Checks inactivity of any user on a service. Those privileges should be removed for better security posture.

Risk Level

Medium

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS AWS
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Prevention

How to Prevent

Using Console

To prevent User Account Service Inactivity in IAM using the AWS Management Console, follow these steps:

1. Enable IAM Access Analyzer:

   • Navigate to the IAM dashboard in the AWS Management Console.
   • In the left-hand navigation pane, select “Access Analyzer.”
   • Click on “Create analyzer” and follow the prompts to enable IAM Access Analyzer. This tool helps you identify inactive IAM users and roles.

2. Set Up Password Policy:

   • In the IAM dashboard, select “Account settings” from the left-hand navigation pane.
   • Under “Password policy,” configure settings such as password expiration and password reuse prevention. This ensures that users must periodically update their passwords, reducing the risk of inactive accounts.

3. Enable CloudTrail Logging:

   • Go to the CloudTrail dashboard in the AWS Management Console.
   • Click on “Create trail” and follow the prompts to enable logging for all regions.
   • Ensure that CloudTrail is configured to log IAM actions. This helps you monitor user activity and identify inactive accounts.

4. Set Up Automated Notifications:

   • Navigate to the CloudWatch dashboard in the AWS Management Console.
   • Create a new rule to monitor IAM user activity.
   • Set up an alarm to trigger an SNS (Simple Notification Service) notification if a user account has been inactive for a specified period. This allows you to take proactive measures to address inactivity.

By following these steps, you can effectively monitor and manage user account activity in AWS IAM, reducing the risk of inactive accounts.

Using CLI

To prevent User Account Service Inactivity in IAM using AWS CLI, you can follow these steps:

1. Create an IAM Policy to Enforce Password Rotation: Ensure that users are required to change their passwords regularly to prevent inactivity. Create a policy that enforces password rotation.

   aws iam create-account-password-policy \
       --minimum-password-length 12 \
       --require-symbols \
       --require-numbers \
       --require-uppercase-characters \
       --require-lowercase-characters \
       --allow-users-to-change-password \
       --max-password-age 90 \
       --password-reuse-prevention 5
   

2. Enable MFA for IAM Users: Require Multi-Factor Authentication (MFA) for all IAM users to ensure that accounts are actively used and secured.

   aws iam create-virtual-mfa-device --virtual-mfa-device-name MyVirtualMFADevice
   aws iam enable-mfa-device --user-name MyUserName --serial-number arn:aws:iam::123456789012:mfa/MyVirtualMFADevice --authentication-code1 123456 --authentication-code2 654321
   

3. Set Up CloudWatch Alarms for Inactive Users: Create CloudWatch alarms to monitor and alert you when users have not logged in for a specified period.

   aws cloudwatch put-metric-alarm \
       --alarm-name InactiveUserAlarm \
       --metric-name UserLogin \
       --namespace AWS/IAM \
       --statistic Sum \
       --period 86400 \
       --threshold 1 \
       --comparison-operator LessThanThreshold \
       --dimensions Name=UserName,Value=MyUserName \
       --evaluation-periods 30 \
       --alarm-actions arn:aws:sns:us-east-1:123456789012:MySNSTopic
   

4. Automate Inactive User Deactivation: Use a Lambda function to automatically deactivate users who have been inactive for a specified period. This requires setting up a Lambda function and a CloudWatch event rule to trigger it.

   aws lambda create-function \
       --function-name DeactivateInactiveUsers \
       --runtime python3.8 \
       --role arn:aws:iam::123456789012:role/MyLambdaRole \
       --handler lambda_function.lambda_handler \
       --zip-file fileb://function.zip
   
   aws events put-rule \
       --name InactiveUserCheck \
       --schedule-expression "rate(1 day)"
   
   aws events put-targets \
       --rule InactiveUserCheck \
       --targets "Id"="1","Arn"="arn:aws:lambda:us-east-1:123456789012:function:DeactivateInactiveUsers"
   

These steps will help you prevent user account service inactivity by enforcing password policies, enabling MFA, monitoring user activity, and automating the deactivation of inactive users.

Using Python

To prevent User Account Service Inactivity in IAM using Python scripts, you can follow these steps:

1. Set Up AWS SDK (Boto3)

First, ensure you have the AWS SDK for Python (Boto3) installed. You can install it using pip if you haven’t already:

pip install boto3

2. Create a Script to List Inactive Users

Create a Python script to list users who have been inactive for a specified period. This script will help you identify inactive users.

import boto3
from datetime import datetime, timedelta

# Initialize a session using Amazon IAM
iam = boto3.client('iam')

# Define the inactivity period (e.g., 90 days)
inactivity_period = 90
threshold_date = datetime.now() - timedelta(days=inactivity_period)

# List all IAM users
users = iam.list_users()

# Check for inactive users
inactive_users = []
for user in users['Users']:
    if 'PasswordLastUsed' in user:
        last_used = user['PasswordLastUsed']
        if last_used < threshold_date:
            inactive_users.append(user['UserName'])

print("Inactive users:", inactive_users)

3. Automate Deactivation of Inactive Users

Modify the script to deactivate users who have been inactive for the specified period. This can be done by disabling their login profile and access keys.

for user in inactive_users:
    # Deactivate login profile
    try:
        iam.delete_login_profile(UserName=user)
        print(f"Deleted login profile for user: {user}")
    except iam.exceptions.NoSuchEntityException:
        print(f"No login profile found for user: {user}")

    # Deactivate access keys
    access_keys = iam.list_access_keys(UserName=user)
    for key in access_keys['AccessKeyMetadata']:
        iam.update_access_key(UserName=user, AccessKeyId=key['AccessKeyId'], Status='Inactive')
        print(f"Deactivated access key {key['AccessKeyId']} for user: {user}")

4. Schedule the Script to Run Periodically

Use a scheduling tool like cron (on Unix-based systems) or Task Scheduler (on Windows) to run the script periodically. This ensures that inactive users are regularly identified and deactivated.

Example Cron Job (Unix-based systems):

# Open the crontab file
crontab -e

# Add the following line to run the script every day at midnight
0 0 * * * /usr/bin/python3 /path/to/your/script.py

By following these steps, you can automate the process of identifying and deactivating inactive IAM users using Python scripts, thereby preventing user account service inactivity in AWS IAM.

Cause

Check Cause

Using Console

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

2. In the navigation pane, choose “Users”. This will display a list of all the IAM users in your AWS account.

3. Choose a user name from the list. This will open the summary page for the chosen user.

4. In the “User Activity” section, you can see the “Last activity” information. This shows the last time the user accessed AWS services. If the “Last activity” shows “None”, it means the user has not accessed any AWS services and is inactive.

Using CLI

1. Install and configure AWS CLI: Before you can start using AWS CLI, you need to install it on your local machine and configure it with your AWS account credentials. You can do this by running the following commands:

   Installation:

   pip install awscli
   

   Configuration:

   aws configure
   

   You will be prompted to provide your AWS Access Key ID, Secret Access Key, Default region name, and Default output format.

2. List all IAM users: Once AWS CLI is set up, you can list all IAM users in your AWS account by running the following command:

   aws iam list-users
   

   This command will return a JSON object containing details of all IAM users.

3. Get IAM user’s last activity date: For each user, you can get the last activity date by running the following command:

   aws iam get-user --user-name <username>
   

   Replace <username> with the name of the IAM user. This command will return a JSON object containing details of the specified IAM user, including the PasswordLastUsed field which indicates the date and time when the IAM user last used their password for AWS Management Console or AWS CLI operations.

4. Check for inactivity: You can then check if the PasswordLastUsed date is older than your inactivity threshold (for example, 90 days). If it is, then the IAM user is considered inactive. You can do this check manually or write a script to automate the process.

Using Python

1. Import necessary libraries and establish a connection with AWS IAM: You need to import the boto3 library, which is the Amazon Web Services (AWS) SDK for Python. It allows Python developers to write software that makes use of services like Amazon S3, Amazon EC2, and others. After importing the necessary libraries, establish a connection with AWS IAM.

   import boto3
   import datetime
   from dateutil.tz import tzutc
   
   # Create IAM client
   iam = boto3.client('iam')
   

2. Fetch all the users: Use the list_users() function to fetch all the users. This function returns a list of IAM users for the AWS account.

   # List all users
   users = iam.list_users()
   

3. Check the last activity of each user: For each user, fetch the access key details using the list_access_keys() function. This function returns metadata about the access keys associated with the specified IAM user. If the user has not used their access key for a certain period, flag them as inactive.

   # Define the inactivity period (e.g., 90 days)
   inactivity_period = datetime.timedelta(days=90)
   
   for user in users['Users']:
       access_keys = iam.list_access_keys(UserName=user['UserName'])
   
       for key in access_keys['AccessKeyMetadata']:
           last_used_response = iam.get_access_key_last_used(AccessKeyId=key['AccessKeyId'])
           last_used_date = last_used_response['AccessKeyLastUsed']['LastUsedDate']
   
           if (datetime.datetime.now(tzutc()) - last_used_date) > inactivity_period:
               print(f"User {user['UserName']} is inactive.")
   

4. Interpret the results: The script will print the usernames of all users who have not used their access keys for more than the specified inactivity period. If no such users are found, the script will not print anything. This script can be run periodically to monitor user activity and detect any inactive users.

Remediation

Remediation

Using Console

To remediate the User Account Service Inactivity issue in AWS using the AWS console, you can follow these steps:

1. Log in to your AWS Management Console.
2. Go to the IAM service.
3. Click on the “Users” option in the left-hand menu.
4. Select the user account that has been inactive.
5. Click on the “Security credentials” tab.
6. Under “Console password”, click on “Manage”.
7. Follow the prompts to reset the user’s password.
8. Click on the “Access keys” tab.
9. Delete any access keys that have not been used in the last 90 days.
10. Click on the “Permissions” tab.
11. Review the user’s permissions and remove any that are no longer necessary.
12. Click on the “Groups” tab.
13. Review the groups the user is a member of and remove any that are no longer necessary.
14. Click on the “Policies” tab.
15. Review the policies attached to the user and remove any that are no longer necessary.
16. Click on “Apply” to save the changes.

These steps will remediate the User Account Service Inactivity issue in AWS by resetting the user’s password, deleting unused access keys, reviewing and removing unnecessary permissions, groups, and policies.

Using CLI

The following steps can be taken to remediate the User Account Service Inactivity misconfiguration in AWS using AWS CLI:

1. Open the AWS CLI on your local machine or EC2 instance.

2. Run the following command to list all the IAM users in your AWS account:

   aws iam list-users
   

3. Identify the inactive users from the list. Inactive users are those who have not logged in to their AWS account for a specified number of days.

4. To set a password policy, run the following command:

   aws iam update-account-password-policy --minimum-password-length 8 --require-symbols --require-numbers --require-uppercase-characters --require-lowercase-characters --allow-users-to-change-password --max-password-age 90 --password-reuse-prevention 5
   

   This command will set a password policy for your AWS account. You can modify the parameters as per your requirement.

5. To force an IAM user to reset their password on next login, run the following command:

   aws iam update-login-profile --user-name <user-name> --password-reset-required
   

   Replace <user-name> with the name of the inactive user. This command will force the user to reset their password on their next login.

6. Repeat steps 4 and 5 for all the inactive users in your AWS account.

7. Finally, run the following command to verify that the password policy has been updated successfully:

   aws iam get-account-password-policy
   

   This command will display the current password policy for your AWS account.

By following these steps, you can remediate the User Account Service Inactivity misconfiguration in AWS using AWS CLI.

Using Python

To remediate the User Account Service Inactivity misconfiguration in AWS using Python, you can follow these steps:

1. First, you need to identify the user accounts that have been inactive for a specified period. You can use the boto3 library in Python to interact with AWS services.

import boto3
from datetime import datetime, timedelta

# Set the time period for inactivity
inactivity_period = 90

# Create a boto3 client for AWS IAM
iam = boto3.client('iam')

# Get the list of all IAM users
users = iam.list_users()['Users']

# Iterate over each user and check their last activity date
for user in users:
    # Get the user's access keys
    access_keys = iam.list_access_keys(UserName=user['UserName'])['AccessKeyMetadata']
    
    # Check if any access keys are active
    for key in access_keys:
        if key['Status'] == 'Active':
            # Get the last time the access key was used
            last_used = iam.get_access_key_last_used(AccessKeyId=key['AccessKeyId'])['AccessKeyLastUsed']['LastUsedDate']
            
            # Check if the access key has been inactive for the specified period
            if last_used < datetime.now() - timedelta(days=inactivity_period):
                # The access key has been inactive for too long, disable it
                iam.update_access_key(AccessKeyId=key['AccessKeyId'], Status='Inactive')

2. The code above will disable the access keys for any user that has been inactive for the specified period. You can adjust the inactivity_period variable to suit your needs.

3. You can schedule this script to run periodically using a cron job or a similar scheduling tool. This will ensure that any inactive access keys are disabled automatically.

Using Terraform

# Example 1: Detach an unused managed policy from a user
# Replace PLACEHOLDERS with real values, and REMOVE the attachment block entirely
# if you want to detach the policy.
resource "aws_iam_user" "user" {
  name = "IAM_USER_NAME" # substitute: the IAM user name
}

# If this attachment currently exists in your code and grants only unused service
# permissions, delete this whole resource from Terraform to detach it.
resource "aws_iam_user_policy_attachment" "unused_service" {
  user       = aws_iam_user.user.name
  policy_arn = "POLICY_ARN_TO_DETACH" # substitute: ARN of the managed policy granting the unused permissions
}

# Example 2: Delete or edit an inline policy on the user
# If the entire inline policy is only for the unused service, remove this resource
# entirely from Terraform to delete it from the user.
resource "aws_iam_user_policy" "unused_service" {
  user   = aws_iam_user.user.name
  name   = "INLINE_POLICY_NAME_TO_DELETE" # substitute: the inline policy name
  policy = data.aws_iam_policy_document.unused_service.json
}

# If only some statements are unused, EDIT the data source below to remove
# just those statements instead of deleting the whole resource.
data "aws_iam_policy_document" "unused_service" {
  statement {
    sid = "ONLY_NEEDED_PERMISSIONS" # keep only permissions still required

    actions   = ["SERVICE:ACTION"]  # adjust to required actions
    resources = ["*"]
  }
}

# Example 3: Remove user from a group that only grants unused permissions
# If the group membership is the source of the unused service permissions and the
# user no longer needs anything from that group, remove this resource from Terraform.
resource "aws_iam_user_group_membership" "group_membership" {
  user = aws_iam_user.user.name

  groups = [
    "GROUP_NAME_TO_REMOVE_FROM", # substitute: group that grants only unused permissions
    # include any other groups the user must remain in
  ]
}

These Terraform changes match the CLI remediation:

• Investigate which attachment, inline policy, or group grants the unused service permissions (outside Terraform, using aws iam list-* and CloudTrail as per AWS docs).
• Then either remove the corresponding aws_iam_user_policy_attachment, aws_iam_user_policy, or aws_iam_user_group_membership resource (or edit the policy document to drop only the unused statements).

Removing these Terraform resources is destructive for those permissions (but does not delete the IAM user itself). Apply only after confirming they are no longer needed.

For verification, terraform plan should show:

• - (destroy) for each aws_iam_user_policy_attachment, aws_iam_user_policy, or aws_iam_user_group_membership you removed, or
• ~ (update in-place) for any aws_iam_user_policy whose policy document you edited to drop unused statements.

Additional Reading:

• https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_finding-unused.html