Back to Checks
huaweicloud

IAM disabled users are reviewed and removed if stale

iam_user_disabled
Service: iamSeverity: low
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

Disabled IAM user accounts that are no longer needed should be removed to reduce the attack surface. Stale disabled accounts may still have associated resources, permissions, or access keys that could be exploited if re-enabled.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

Disabled IAM users may retain permissions and access keys that could be re-enabled by an attacker with sufficient privileges. Keeping stale accounts increases the attack surface and complicates access management audits.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks iam_user_disabled

Recommendation

Review disabled IAM users and remove accounts that are no longer needed.

Remediation

CLI

hcloud IAM KeystoneDeleteUser --user_id=<user_id>

Other

1Log on to the **Huawei Cloud console**.
2Choose **IAM & Security**.
3Click **Users**.
4Review disabled users.
5Delete users that are no longer needed.
6Click **OK**.

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.iam.iam_client import iam_client


class iam_user_disabled(Check):
    """Check if Huawei Cloud IAM has disabled users (stale accounts)."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        for user in iam_client.users:
            report = CheckReportHuaweiCloud(metadata=self.metadata(), resource=user)
            report.region = iam_client.region
            report.resource_id = user.id
            report.resource_arn = (
                f"HUAWEICLOUD::IAM::{iam_client.audited_account}:user/{user.id}"
            )

            if user.enabled:
                report.status = "PASS"
                report.status_extended = f"IAM user {user.name} ({user.id}) is enabled."
            else:
                report.status = "FAIL"
                report.status_extended = f"IAM user {user.name} ({user.id}) is disabled and should be reviewed for removal if no longer needed."

            findings.append(report)

        return findings

References