Back to Checks
aws

IAM user has at most one active access key

iam_user_two_active_access_key
Service: iamSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesssecrets
Resource Type:AwsIamUser

IAM users are evaluated for having two Active access keys simultaneously.

The check identifies users whose two access key slots are enabled at the same time.

Prowler logoProwlerprowler-provider-aws

Risk

Two active keys per user widen exposure and weaken credential governance.

  • Any leaked key enables unauthorized API actions, risking data exfiltration and resource changes
  • Rotation and response become error-prone, allowing attacker persistence if one key remains unnoticed

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_user_two_active_access_key

Recommendation

Maintain one Active access key per IAM user; permit only a brief overlap for rotation, then promptly deactivate and delete the old key. Prefer temporary credentials via roles/federation over long-lived keys. Apply least privilege, periodic rotation, and monitor for unused or aged keys.

Remediation

CLI

aws iam update-access-key --user-name <IAM_USER_NAME> --access-key-id <ACCESS_KEY_ID> --status Inactive

Terraform

# Deactivate one IAM access key so the user has at most one active key
resource "aws_iam_access_key" "<example_resource_name>" {
  user   = "<example_resource_name>"
  status = "Inactive"  # Critical: deactivates this key to avoid 2 active keys
}

NativeIaC

# CloudFormation: set one IAM access key to Inactive to ensure only one active key
Resources:
  <example_resource_name>:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: <example_resource_name>
      Status: Inactive  # Critical: deactivates this key so the user doesn't have 2 active keys

Other

1In the AWS Console, go to IAM > Users
2Open the affected user and select the Security credentials tab
3In Access keys, find one of the two Active keys
4Click Actions > Deactivate on that key
5Verify only one key remains Active

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.lib.logger import logger
from prowler.providers.aws.services.iam.iam_client import iam_client


class iam_user_two_active_access_key(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []
        try:
            response = iam_client.credential_report
            for user in response:
                report = Check_Report_AWS(metadata=self.metadata(), resource=user)
                report.resource_id = user["user"]
                report.resource_arn = user["arn"]
                report.region = iam_client.region
                # Search user in iam_client.users to get tags
                for iam_user in iam_client.users:
                    if iam_user.arn == user["arn"]:
                        report.resource_tags = iam_user.tags
                        break
                if (
                    user["access_key_1_active"] == "true"
                    and user["access_key_2_active"] == "true"
                ):
                    report.status = "FAIL"
                    report.status_extended = (
                        f"User {user['user']} has 2 active access keys."
                    )
                else:
                    report.status = "PASS"
                    report.status_extended = (
                        f"User {user['user']} does not have 2 active access keys."
                    )
                findings.append(report)
        except Exception as error:
            logger.error(f"{error.__class__.__name__} -- {error}")
        return findings

References