Description

Detects AWS IAM users that have both console password access and API access keys enabled simultaneously. This configuration increases security risk by providing multiple authentication methods that could be compromised, violating the principle of least privilege.

Detection Strategy

• Checks each IAM user in the AWS account for presence of active access keys

• Verifies if the same user also has console password access enabled via login profile

• Reports a vulnerability when a user has both authentication methods (password and access keys) active