Description

Detects IAM users who have active access keys that haven't been rotated in over 90 days. Having old access keys increases security risk since compromised credentials would remain valid for longer periods, potentially leading to unauthorized access.

Detection Strategy

• Examines both access keys (access_key_1 and access_key_2) for each IAM user

• Reports a vulnerability if any active access key's last rotation date is more than 90 days old

• Only checks users who have active access keys (access_key_1_active or access_key_2_active is true)