---
title: Unused credentials should be deactivated or removed
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Unused credentials should be
  deactivated or removed
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Unused credentials should be deactivated or removed
 
## Description{% #description %}

AWS IAM users can access AWS resources using credentials such as console passwords and access keys. Any active console password or access key that has not been used for 45 days or more should be deactivated or removed. This rule uses the `password_last_used`, `access_key_1_last_used_date`, and `access_key_2_last_used_date` fields in the IAM credential report. For credentials that have never been used, it uses the last change or rotation date instead. Disabling or removing unused credentials reduces the window of opportunity for credentials associated with a compromised or abandoned account to be used.

## Remediation{% #remediation %}

1. In the [IAM console](https://console.aws.amazon.com/iam), select the user, open **Security credentials**, choose **Manage console access** and select **Disable access** if the console last sign-in is 45 days or more ago, or run `aws iam delete-login-profile --user-name <user-name>`.
1. In the **Access keys** section, deactivate unused keys or delete keys that are no longer required, or run `aws iam delete-access-key --access-key-id <access-key-id> --user-name <user-name>`. See [Finding unused AWS credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_finding-unused.html) for details.

## References{% #references %}

- [Finding unused AWS credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_finding-unused.html)
- [Getting credential reports for your AWS account](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)