IAM Security Audit
Review and secure your AWS access controls
šµ Cost: IAM is completely FREE. You can create unlimited users, roles, policies, and groups at no cost. IAM Access Analyzer is also free. Security Hub has a 30-day free trial, then charges per check.
Why Audit IAM?
IAM (Identity and Access Management) controls who can do what in your AWS account. A misconfigured IAM policy can expose your entire infrastructure. Regular audits ensure you follow the principle of least privilege.
Security First
IAM Audit Checklist
Review IAM Users
Check for unused users, users without MFA, and users with console access who should not have it.
Audit Access Keys
Find and rotate old access keys. Delete keys that have not been used in 90+ days.
Check IAM Policies
Look for overly permissive policies like AdministratorAccess on non-admin users.
Review IAM Roles
Ensure roles follow least-privilege. Check trust relationships for cross-account access.
Enable CloudTrail
Ensure all API calls are logged for security audit purposes.
user,arn,user_creation_time,password_enabled,password_last_used,mfa_active,access_key_1_active,access_key_1_last_used_date admin,arn:aws:iam::123456789:user/admin,2024-01-01,true,2024-01-15,true,false,N/A old-developer,arn:aws:iam::123456789:user/old-developer,2023-06-01,true,2023-09-15,false,true,2023-10-01
Red Flags
mfa_active: false- User has no MFA enabledpassword_last_used: N/Aor old date - Potentially unused useraccess_key_1_last_used: N/A- Access key never used
# List access keys older than 90 days
aws iam list-users --query 'Users[*].UserName' --output text | while read user; do
echo "User: $user"
aws iam list-access-keys --user-name $user --query 'AccessKeyMetadata[?CreateDate<`2024-01-01`]'
done{
"PolicyGroups": [],
"PolicyUsers": [
{
"UserName": "dev-user-fargate",
"UserId": "AIDAEXAMPLE"
}
],
"PolicyRoles": []
}Only break-glass admin accounts should have AdministratorAccess. Regular users should have specific permissions for their tasks.