Description

Detects AWS IAM users who have SSH public keys that are older than 90 days. Old SSH public keys pose a security risk as they may be compromised or forgotten, potentially allowing unauthorized access to systems.

Detection Strategy

• Lists all IAM users in the AWS account

• For each user, retrieves their SSH public keys

• Flags any SSH public key with an upload date more than 90 days ago

• Reports the user ARN and upload date for each old SSH key found