IAM user has too many access keys

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: terraform-aws-iam-user-too-many-access-keys

Provider: AWS

Platform: Terraform

Severity: Medium

Category: Insecure Configurations

Learn More

Description

IAM users should not have more than one active access key at a time, as shown by multiple aws_iam_access_key resources provisioned for the same user. Allowing more than one access key per user increases the attack surface by providing additional credentials that might be lost, leaked, or forgotten, making unauthorized access and credential compromise more likely if keys are not properly rotated or managed. To mitigate this risk, limit each IAM user to a single access key and revoke any unused or unnecessary keys to maintain strong security hygiene.

Compliant Code Examples

resource "aws_iam_user" "userExample" {
  name = "loadbalancer"
  path = "/system/"

  tags = {
    tag-key = "tag-value"
  }
}

resource "aws_iam_access_key" "negative1" {
  user    = aws_iam_user.userExample.name
  pgp_key = "keybase:some_person_that_exists"
}

resource "aws_iam_user" "alice" {
  name = "alice.team.prod"
}

resource "aws_iam_user" "bob" {
  name = "bob.team.dev"
}

resource "aws_iam_access_key" "negative2_alice" {
  user = aws_iam_user.alice.name
}

resource "aws_iam_access_key" "negative2_bob" {
  user = aws_iam_user.bob.name
}

Non-Compliant Code Examples

resource "aws_iam_access_key" "positive1" {
  user    = aws_iam_user.lb.name
  pgp_key = "keybase:some_person_that_exists"
}

resource "aws_iam_access_key" "positive2" {
  user    = aws_iam_user.lb.name
  pgp_key = "keybase:some_person_that_exists"
}


resource "aws_iam_user" "lb" {
  name = "loadbalancer"
  path = "/system/"
}

resource "aws_iam_user" "carol" {
  name = "carol.team.prod"
}

resource "aws_iam_access_key" "positive2_a" {
  user = aws_iam_user.carol.name
}

resource "aws_iam_access_key" "positive2_b" {
  user = aws_iam_user.carol.name
}

resource "aws_iam_user" "dave" {
  name = "dave-user"
}

resource "aws_iam_access_key" "positive3_ref" {
  user = aws_iam_user.dave.name
}

resource "aws_iam_access_key" "positive3_literal" {
  user = "dave-user"
}