Description

Detects AWS IAM users who have multiple active access keys configured. Having multiple active access keys for a single IAM user increases security risk by expanding the attack surface and making key rotation more difficult. AWS best practices recommend using only one active access key per user.

Detection Strategy

• Scans all IAM users in the AWS account

• Checks the number of access keys with 'Active' status for each user

• Reports a security finding when an IAM user has more than one active access key