AWS IAM Hardening

Enable a hardware FIDO2 security key (or, at minimum, a virtual TOTP device backed up offline) as the MFA device on the root user of every AWS account, including every member account of an AWS Organization. AWS announced in 2024 that root-user MFA is becoming mandatory for the management account and is being progressively rolled out across member accounts; planning teams should treat this as an in-flight enforcement rather than an optional best practice (AWS Security Blog — root MFA mandate announcement 2024 (accessed 2026-05)). The principle is reinforced in the General IAM — MFA section and the severity derivation is worked end-to-end in methodology EX-MFA-01.

Remediation — AWS CLI

# Hardware/virtual root MFA is registered through the console (Security credentials
# > Multi-factor authentication). The CLI cannot enrol the root user's MFA device
# because the root principal cannot be assumed programmatically. After enrolment,
# verify from any admin-credentialed session:
aws iam get-account-summary \
  --query 'SummaryMap.AccountMFAEnabled' \
  --output text
# Expected: 1

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Root MFA enrolment itself is a console action; this SCP enforces the
# organisational invariant "no root action without MFA present" against
# every member account.
resource "aws_organizations_policy" "deny_root_without_mfa" {
  name = "deny-root-without-mfa"
  type = "SERVICE_CONTROL_POLICY"
  content = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Sid       = "DenyRootWithoutMFA"
      Effect    = "Deny"
      Action    = "*"
      Resource  = "*"
      Condition = {
        Bool       = { "aws:MultiFactorAuthPresent" = "false" }
        StringLike = { "aws:PrincipalArn" = "arn:aws:iam::*:root" }
      }
    }]
  })
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: SCP enforcing "no root action without MFA present" across member accounts.
Parameters:
  OrgRootId:
    Type: String
    Description: AWS Organizations root or OU id to attach the SCP to.
Resources:
  DenyRootWithoutMfa:
    Type: AWS::Organizations::Policy
    Properties:
      Name: deny-root-without-mfa
      Type: SERVICE_CONTROL_POLICY
      TargetIds:
        - !Ref OrgRootId
      Content:
        Version: '2012-10-17'
        Statement:
          - Sid: DenyRootWithoutMFA
            Effect: Deny
            Action: '*'
            Resource: '*'
            Condition:
              Bool:
                aws:MultiFactorAuthPresent: 'false'
              StringLike:
                aws:PrincipalArn: 'arn:aws:iam::*:root'

Remediation — AWS CDK (TypeScript)

import * as cdk from 'aws-cdk-lib';
import { aws_organizations as orgs } from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class DenyRootWithoutMfaStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: cdk.StackProps & { orgRootId: string }) {
    super(scope, id, props);

    new orgs.CfnPolicy(this, 'DenyRootWithoutMfa', {
      name: 'deny-root-without-mfa',
      type: 'SERVICE_CONTROL_POLICY',
      targetIds: [props.orgRootId],
      content: JSON.stringify({
        Version: '2012-10-17',
        Statement: [{
          Sid: 'DenyRootWithoutMFA',
          Effect: 'Deny',
          Action: '*',
          Resource: '*',
          Condition: {
            Bool: { 'aws:MultiFactorAuthPresent': 'false' },
            StringLike: { 'aws:PrincipalArn': 'arn:aws:iam::*:root' },
          },
        }],
      }),
    });
  }
}

Compliance mapping

fields @timestamp, userIdentity.type, eventName, additionalEventData.MFAUsed, sourceIPAddress, awsRegion
| filter userIdentity.type = "Root"
| filter eventName = "ConsoleLogin" or eventName like /MFADevice/
| sort @timestamp desc
| limit 200

Equivalent on: Azure · GCP · OCI

The root user must hold zero long-lived access keys. AWS has documented for many years that the root user should be used only for the small set of actions that nothing else can perform (closing the account, changing payment instruments, registering as a seller); using a root access key for routine workload calls is the highest-leverage credential compromise possible (AWS IAM User Guide — security best practices (accessed 2026-05)). Confirm both that no key currently exists and that the account-wide policy forbids creating one.

Remediation — AWS CLI

# Audit: confirm root has zero access keys (uses credential-report data).
aws iam generate-credential-report
aws iam get-credential-report \
  --query 'Content' --output text \
  | base64 -d \
  | awk -F, 'NR==1 || $1=="<root_account>"' \
  | cut -d, -f1,9,11
# Expect access_key_1_active=false and access_key_2_active=false.

# If a root key exists, delete it (must be run as root from the console / CLI):
aws iam delete-access-key --access-key-id <AKIA...>

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Organisation-wide SCP denying the CreateAccessKey API when the calling
# principal is the root user of any member account.
resource "aws_organizations_policy" "deny_root_create_access_key" {
  name = "deny-root-create-access-key"
  type = "SERVICE_CONTROL_POLICY"
  content = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Sid       = "DenyRootCreateAccessKey"
      Effect    = "Deny"
      Action    = ["iam:CreateAccessKey", "iam:UpdateAccessKey"]
      Resource  = "*"
      Condition = {
        StringLike = { "aws:PrincipalArn" = "arn:aws:iam::*:root" }
      }
    }]
  })
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: SCP forbidding any IAM action that creates access keys for the root principal.
Parameters:
  OrgRootId:
    Type: String
Resources:
  DenyRootKeyCreation:
    Type: AWS::Organizations::Policy
    Properties:
      Name: deny-root-access-key-creation
      Type: SERVICE_CONTROL_POLICY
      TargetIds:
        - !Ref OrgRootId
      Content:
        Version: '2012-10-17'
        Statement:
          - Sid: DenyRootAccessKeyCreate
            Effect: Deny
            Action:
              - iam:CreateAccessKey
              - iam:UpdateAccessKey
            Resource: '*'
            Condition:
              StringLike:
                aws:PrincipalArn: 'arn:aws:iam::*:root'

Remediation — AWS CDK (TypeScript)

import * as cdk from 'aws-cdk-lib';
import { aws_organizations as orgs } from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class DenyRootKeyCreationStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: cdk.StackProps & { orgRootId: string }) {
    super(scope, id, props);

    new orgs.CfnPolicy(this, 'DenyRootKeyCreation', {
      name: 'deny-root-access-key-creation',
      type: 'SERVICE_CONTROL_POLICY',
      targetIds: [props.orgRootId],
      content: JSON.stringify({
        Version: '2012-10-17',
        Statement: [{
          Sid: 'DenyRootAccessKeyCreate',
          Effect: 'Deny',
          Action: ['iam:CreateAccessKey', 'iam:UpdateAccessKey'],
          Resource: '*',
          Condition: {
            StringLike: { 'aws:PrincipalArn': 'arn:aws:iam::*:root' },
          },
        }],
      }),
    });
  }
}

Compliance mapping

fields @timestamp, eventName, userIdentity.arn, sourceIPAddress, requestParameters.userName, errorCode
| filter eventName in ["CreateAccessKey","UpdateAccessKey"]
| filter userIdentity.type = "Root" or requestParameters.userName like /:root$/
| sort @timestamp desc
| limit 50

Equivalent on: Azure · GCP · OCI

Human access to AWS accounts should flow through IAM Identity Center — the service formerly known as AWS SSO, which AWS renamed in 2022; new content should never use the old name (AWS IAM Identity Center user guide (accessed 2026-05)). Identity Center federates from an upstream identity provider (Okta, Entra ID, JumpCloud, Identity Center's own directory) and issues short-lived role-session credentials per account through permission sets, replacing long-lived IAM users for humans.

Remediation — AWS CLI

# Create a permission set scoped to a managed policy.
aws sso-admin create-permission-set \
  --instance-arn arn:aws:sso:::instance/<SSOINS_ID> \
  --name ReadOnlyAuditors \
  --session-duration PT4H

# Attach the managed policy and assign to a group in a member account.
aws sso-admin attach-managed-policy-to-permission-set \
  --instance-arn arn:aws:sso:::instance/<SSOINS_ID> \
  --permission-set-arn arn:aws:sso:::permissionSet/<PS_ID> \
  --managed-policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

Remediation — Terraform

# Terraform AWS provider ~> 5.0
data "aws_ssoadmin_instances" "this" {}

resource "aws_ssoadmin_permission_set" "read_only" {
  name             = "ReadOnlyAuditors"
  instance_arn     = tolist(data.aws_ssoadmin_instances.this.arns)[0]
  session_duration = "PT4H"
}

resource "aws_ssoadmin_managed_policy_attachment" "read_only" {
  instance_arn       = tolist(data.aws_ssoadmin_instances.this.arns)[0]
  managed_policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
  permission_set_arn = aws_ssoadmin_permission_set.read_only.arn
}

resource "aws_ssoadmin_account_assignment" "read_only_auditors" {
  instance_arn       = tolist(data.aws_ssoadmin_instances.this.arns)[0]
  permission_set_arn = aws_ssoadmin_permission_set.read_only.arn
  principal_id       = var.auditors_group_id
  principal_type     = "GROUP"
  target_id          = var.target_account_id
  target_type        = "AWS_ACCOUNT"
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: AWS IAM Identity Center permission set with session duration and managed policy boundary.
Parameters:
  InstanceArn:
    Type: String
    Description: IAM Identity Center instance ARN (sso:DescribeInstances).
Resources:
  ReadOnlyPermissionSet:
    Type: AWS::SSO::PermissionSet
    Properties:
      Name: org-read-only
      Description: SSO permission set granting AWS-managed ReadOnlyAccess.
      InstanceArn: !Ref InstanceArn
      SessionDuration: PT1H
      ManagedPolicies:
        - arn:aws:iam::aws:policy/ReadOnlyAccess

Compliance mapping

fields @timestamp, eventName, userIdentity.type, userIdentity.userName, recipientAccountId, sourceIPAddress
| filter eventName = "ConsoleLogin" and userIdentity.type = "IAMUser"
| filter userIdentity.userName not like /^break-glass-/
| stats count() as logins by userIdentity.userName, recipientAccountId
| sort logins desc

Equivalent on: Azure · GCP · OCI

For accounts that still contain IAM users with console passwords — typically legacy accounts pre-dating Identity Center, plus break-glass users — every such user must have an MFA device enrolled and a policy condition that denies all actions until MFA is presented. CIS AWS Foundations v3.0.0 control 1.10 mandates this for any IAM user with a console password (CIS Amazon Web Services Foundations Benchmark v3.0.0 — Jan 2024 release (accessed 2026-05)).

Remediation — AWS CLI

# List users with console passwords and check whether each has an MFA device.
aws iam list-users --query 'Users[].UserName' --output text \
  | tr '\t' '\n' \
  | while read u; do
      pw=$(aws iam get-login-profile --user-name "$u" 2>/dev/null && echo yes || echo no)
      mfa=$(aws iam list-mfa-devices --user-name "$u" \
            --query 'length(MFADevices)' --output text)
      printf '%s\tconsole=%s\tmfa_devices=%s\n' "$u" "$pw" "$mfa"
    done

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Group-attached policy denying every action when MFA is not present in the
# session. Attach to every group containing IAM users with console access.
resource "aws_iam_group_policy" "require_mfa" {
  name  = "require-mfa"
  group = aws_iam_group.console_users.name
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Sid      = "DenyAllExceptListedIfNoMFA"
      Effect   = "Deny"
      NotAction = [
        "iam:CreateVirtualMFADevice",
        "iam:EnableMFADevice",
        "iam:GetUser",
        "iam:ListMFADevices",
        "iam:ListVirtualMFADevices",
        "iam:ResyncMFADevice",
        "sts:GetSessionToken"
      ]
      Resource = "*"
      Condition = {
        BoolIfExists = { "aws:MultiFactorAuthPresent" = "false" }
      }
    }]
  })
}

resource "aws_iam_account_password_policy" "strong" {
  minimum_password_length        = 14
  require_symbols                = true
  require_numbers                = true
  require_uppercase_characters   = true
  require_lowercase_characters   = true
  allow_users_to_change_password = true
  password_reuse_prevention      = 24
  max_password_age               = 90
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: IAM managed policy denying every action when MFA is not present, attached at user/group level.
Resources:
  DenyAllExceptMfaSelfService:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: deny-all-without-mfa
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowSelfServiceMfaManagement
            Effect: Allow
            Action:
              - iam:ChangePassword
              - iam:GetUser
              - iam:CreateVirtualMFADevice
              - iam:EnableMFADevice
              - iam:ListMFADevices
              - iam:ResyncMFADevice
            Resource: !Sub 'arn:aws:iam::${AWS::AccountId}:user/${!aws:username}'
          - Sid: DenyAllExceptMfa
            Effect: Deny
            NotAction:
              - iam:ChangePassword
              - iam:CreateVirtualMFADevice
              - iam:EnableMFADevice
              - iam:GetUser
              - iam:ListMFADevices
              - iam:ResyncMFADevice
              - sts:GetSessionToken
            Resource: '*'
            Condition:
              BoolIfExists:
                aws:MultiFactorAuthPresent: 'false'

Remediation — AWS CDK (TypeScript)

import * as cdk from 'aws-cdk-lib';
import { aws_iam as iam } from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class DenyAllWithoutMfaStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    new iam.ManagedPolicy(this, 'DenyAllWithoutMfa', {
      managedPolicyName: 'deny-all-without-mfa',
      document: new iam.PolicyDocument({
        statements: [
          new iam.PolicyStatement({
            sid: 'AllowSelfServiceMfaManagement',
            effect: iam.Effect.ALLOW,
            actions: [
              'iam:ChangePassword',
              'iam:GetUser',
              'iam:CreateVirtualMFADevice',
              'iam:EnableMFADevice',
              'iam:ListMFADevices',
              'iam:ResyncMFADevice',
            ],
            resources: [`arn:aws:iam::${this.account}:user/\${aws:username}`],
          }),
          new iam.PolicyStatement({
            sid: 'DenyAllExceptMfa',
            effect: iam.Effect.DENY,
            notActions: [
              'iam:ChangePassword',
              'iam:CreateVirtualMFADevice',
              'iam:EnableMFADevice',
              'iam:GetUser',
              'iam:ListMFADevices',
              'iam:ResyncMFADevice',
              'sts:GetSessionToken',
            ],
            resources: ['*'],
            conditions: {
              BoolIfExists: { 'aws:MultiFactorAuthPresent': 'false' },
            },
          }),
        ],
      }),
    });
  }
}

Compliance mapping

fields @timestamp, eventName, userIdentity.userName, additionalEventData.MFAUsed, sourceIPAddress, awsRegion
| filter eventName = "ConsoleLogin"
| filter userIdentity.type = "IAMUser"
| filter additionalEventData.MFAUsed = "No"
| sort @timestamp desc
| limit 200

Equivalent on: Azure · GCP · OCI

Any remaining long-lived IAM access keys must be rotated at most every 90 days. Severity is MEDIUM and the type is DETECTIVE rather than PREVENTIVE because rotation does not prevent compromise of an already-active key — an attacker who exfiltrates a fresh key has 90 days of unimpeded use — it bounds the window during which an undiscovered compromise remains usable, and the rotation cadence itself surfaces stale credentials whose owners have left (AWS IAM User Guide — security best practices (accessed 2026-05)). The strategic answer is to eliminate long-lived keys entirely via aws-iam-06-role-assumption; this control is the compensating audit for what remains.

Remediation — AWS CLI

# List keys older than 90 days across all users.
aws iam list-users --query 'Users[].UserName' --output text \
  | tr '\t' '\n' \
  | while read u; do
      aws iam list-access-keys --user-name "$u" \
        --query 'AccessKeyMetadata[?CreateDate<=`'"$(date -u -d '90 days ago' +%Y-%m-%dT%H:%M:%SZ)"'`].[UserName,AccessKeyId,CreateDate]' \
        --output text
    done

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# AWS Config managed rule that flags access keys older than 90 days.
resource "aws_config_config_rule" "access_keys_rotated" {
  name = "access-keys-rotated"
  source {
    owner             = "AWS"
    source_identifier = "ACCESS_KEYS_ROTATED"
  }
  input_parameters = jsonencode({ maxAccessKeyAge = "90" })
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: AWS Config managed rule flagging IAM access keys older than the rotation threshold.
Resources:
  AccessKeyRotationRule:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: access-keys-rotated-90d
      Description: Flags IAM access keys not rotated within maxAccessKeyAge days.
      Source:
        Owner: AWS
        SourceIdentifier: ACCESS_KEYS_ROTATED
      InputParameters: !Sub '{"maxAccessKeyAge":"90"}'

Compliance mapping

fields @timestamp, configurationItem.resourceName, newEvaluationResult.complianceType, configRuleName
| filter configRuleName = "access-keys-rotated"
| filter newEvaluationResult.complianceType = "NON_COMPLIANT"
| stats count() as findings by configurationItem.resourceName
| sort findings desc

Equivalent on: Azure · GCP · OCI

Workload-to-AWS authentication should use IAM roles assumed via STS, not long-lived IAM-user access keys baked into application configuration. The role-assumption surface covers EC2 instance profiles, ECS task roles, Lambda execution roles, and (for Kubernetes workloads on EKS) EKS Pod Identity — the 2023-introduced and now-preferred mechanism — alongside IRSA (IAM Roles for Service Accounts), which remains supported and is the only option in some older clusters (AWS IAM User Guide — security best practices (accessed 2026-05)). Combined with aws-iam-05-key-rotation, eliminating long-lived keys reduces the credential-rotation problem to "rotate the role's trust policy when the trust relationship changes", which is rare.

Remediation — AWS CLI

# Create an EC2-assumable role with a workload-scoped policy attached.
aws iam create-role \
  --role-name app-runtime-role \
  --assume-role-policy-document '{
    "Version":"2012-10-17",
    "Statement":[{
      "Effect":"Allow",
      "Principal":{"Service":"ec2.amazonaws.com"},
      "Action":"sts:AssumeRole"
    }]
  }'

aws iam attach-role-policy \
  --role-name app-runtime-role \
  --policy-arn arn:aws:iam::<ACCOUNT_ID>:policy/app-runtime-policy

# Attach via instance profile.
aws iam create-instance-profile --instance-profile-name app-runtime-profile
aws iam add-role-to-instance-profile \
  --instance-profile-name app-runtime-profile \
  --role-name app-runtime-role

Remediation — Terraform

# Terraform AWS provider ~> 5.0
resource "aws_iam_role" "app_runtime" {
  name = "app-runtime-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "ec2.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_instance_profile" "app_runtime" {
  name = "app-runtime-profile"
  role = aws_iam_role.app_runtime.name
}

# For EKS, prefer Pod Identity (2023+) over IRSA:
resource "aws_eks_pod_identity_association" "app" {
  cluster_name    = var.eks_cluster_name
  namespace       = "default"
  service_account = "app"
  role_arn        = aws_iam_role.app_runtime.arn
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: Cross-account IAM role with external-id condition and short session duration.
Parameters:
  TrustedAccountId:
    Type: String
  ExternalId:
    Type: String
    NoEcho: true
Resources:
  CrossAccountAuditorRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: cross-account-auditor
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${TrustedAccountId}:root'
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: !Ref ExternalId
              Bool:
                aws:MultiFactorAuthPresent: 'true'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/SecurityAudit

Compliance mapping

fields @timestamp, eventName, userIdentity.arn, requestParameters.policyDocument, requestParameters.roleName
| filter eventName = "UpdateAssumeRolePolicy"
| filter requestParameters.policyDocument like /"Principal":\s*"\*"/ or requestParameters.policyDocument like /:root"/
| sort @timestamp desc
| limit 50

Equivalent on: Azure · GCP · OCI

When delegating IAM-management rights to non-admin principals (the canonical case: a platform team gives application teams the ability to create roles for their own workloads), attach a permission boundary to every role created via the delegated path. A permission boundary is an IAM-managed policy that caps the maximum effective permissions of the principal it is attached to; even if the developer attaches AdministratorAccess to a new role, the role's effective permissions remain the intersection of the attached policies and the boundary (AWS IAM User Guide — security best practices (accessed 2026-05)).

Remediation — AWS CLI

# Apply a permission boundary to a delegated developer role.
aws iam put-role-permissions-boundary \
  --role-name developer-role \
  --permissions-boundary arn:aws:iam::<ACCOUNT_ID>:policy/dev-permission-boundary

# Require the boundary on any role the developer creates (use a condition in
# the developer's own policy — see Terraform below).

Remediation — Terraform

# Terraform AWS provider ~> 5.0
resource "aws_iam_policy" "dev_boundary" {
  name   = "dev-permission-boundary"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      { Effect = "Allow", Action = ["s3:*","dynamodb:*","logs:*"], Resource = "*" },
      { Effect = "Deny",  Action = ["iam:*Organizations*","kms:PutKeyPolicy"], Resource = "*" }
    ]
  })
}

resource "aws_iam_role" "developer" {
  name                 = "developer-role"
  permissions_boundary = aws_iam_policy.dev_boundary.arn
  assume_role_policy   = data.aws_iam_policy_document.dev_trust.json
}

# Force the boundary on any role the developer creates.
data "aws_iam_policy_document" "developer_inline" {
  statement {
    effect    = "Allow"
    actions   = ["iam:CreateRole", "iam:AttachRolePolicy"]
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "iam:PermissionsBoundary"
      values   = [aws_iam_policy.dev_boundary.arn]
    }
  }
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: Permission boundary policy capping the privileges any delegated developer role can grant.
Resources:
  DeveloperBoundary:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: developer-boundary
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowAppRuntimeServices
            Effect: Allow
            Action:
              - logs:*
              - s3:*
              - dynamodb:*
              - sqs:*
              - sns:*
            Resource: '*'
          - Sid: DenyIamWriteAndOrganizations
            Effect: Deny
            Action:
              - iam:*
              - organizations:*
              - account:*
            Resource: '*'

Compliance mapping

fields @timestamp, eventName, userIdentity.arn, requestParameters.roleName, requestParameters.permissionsBoundary
| filter eventName in ["CreateRole","PutRolePermissionsBoundary","DeleteRolePermissionsBoundary"]
| filter eventName = "DeleteRolePermissionsBoundary"
  or (eventName = "CreateRole" and isempty(requestParameters.permissionsBoundary))
| sort @timestamp desc
| limit 100

Equivalent on: Azure · GCP · OCI

At the AWS Organizations layer, apply a Service Control Policy (SCP) deny-list that fences destructive actions (CloudTrail disable, KMS key deletion, Config recorder stop) and disallowed regions across every member account. SCPs are the only IAM construct that root cannot bypass: even the root user of a member account is bound by SCPs inherited from the management account (AWS Organizations User Guide — SCP examples (accessed 2026-05)).

Remediation — AWS CLI

# Create a deny-list SCP and attach it to the root or to a specific OU.
cat > deny-destructive.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyDestructiveAudit",
      "Effect": "Deny",
      "Action": [
        "cloudtrail:StopLogging",
        "cloudtrail:DeleteTrail",
        "config:DeleteConfigurationRecorder",
        "config:StopConfigurationRecorder",
        "kms:ScheduleKeyDeletion",
        "kms:DisableKey"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenyDisallowedRegions",
      "Effect": "Deny",
      "NotAction": ["iam:*","sts:*","organizations:*","cloudfront:*","route53:*","support:*"],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": ["eu-west-1","eu-central-1","us-east-1"]
        }
      }
    }
  ]
}
EOF

aws organizations create-policy \
  --type SERVICE_CONTROL_POLICY \
  --name deny-destructive \
  --description "Deny destructive audit actions + disallowed regions" \
  --content file://deny-destructive.json

Remediation — Terraform

# Terraform AWS provider ~> 5.0
resource "aws_organizations_policy" "deny_destructive" {
  name = "deny-destructive"
  type = "SERVICE_CONTROL_POLICY"
  content = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "DenyDestructiveAudit"
        Effect = "Deny"
        Action = [
          "cloudtrail:StopLogging",
          "cloudtrail:DeleteTrail",
          "config:DeleteConfigurationRecorder",
          "config:StopConfigurationRecorder",
          "kms:ScheduleKeyDeletion",
          "kms:DisableKey"
        ]
        Resource = "*"
      },
      {
        Sid       = "DenyDisallowedRegions"
        Effect    = "Deny"
        NotAction = ["iam:*","sts:*","organizations:*","cloudfront:*","route53:*","support:*"]
        Resource  = "*"
        Condition = {
          StringNotEquals = {
            "aws:RequestedRegion" = ["eu-west-1","eu-central-1","us-east-1"]
          }
        }
      }
    ]
  })
}

resource "aws_organizations_policy_attachment" "deny_destructive_root" {
  policy_id = aws_organizations_policy.deny_destructive.id
  target_id = var.organization_root_id
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: SCP deny-list forbidding disablement of audit/security guardrails across member accounts.
Parameters:
  OrgRootId:
    Type: String
Resources:
  DenyDisableSecurityGuardrails:
    Type: AWS::Organizations::Policy
    Properties:
      Name: deny-disable-security-guardrails
      Type: SERVICE_CONTROL_POLICY
      TargetIds:
        - !Ref OrgRootId
      Content:
        Version: '2012-10-17'
        Statement:
          - Sid: DenyDisable
            Effect: Deny
            Action:
              - cloudtrail:StopLogging
              - cloudtrail:DeleteTrail
              - config:DeleteConfigurationRecorder
              - config:DeleteDeliveryChannel
              - config:StopConfigurationRecorder
              - guardduty:DeleteDetector
              - guardduty:DisassociateMembers
              - securityhub:DisableSecurityHub
            Resource: '*'

Compliance mapping

fields @timestamp, eventName, userIdentity.arn, errorCode, errorMessage, awsRegion
| filter errorCode = "AccessDenied" and errorMessage like /service control policy/
| filter eventName in ["StopLogging","DeleteTrail","DeleteConfigurationRecorder","ScheduleKeyDeletion","DisableKey"]
| stats count() as denies by userIdentity.arn, eventName
| sort denies desc

Equivalent on: Azure · GCP · OCI

Enable IAM Access Analyzer in every region of every account, with both an account-level analyzer (zone-of-trust = the AWS account) and, in the delegated-administrator account, an organization-level analyzer (zone-of-trust = the AWS Organization). Access Analyzer continuously evaluates resource policies (S3 buckets, KMS keys, IAM roles, Lambda functions, Secrets Manager secrets, SQS queues, SNS topics, EBS snapshots, ECR repositories, EFS file systems, RDS snapshots) and reports findings whenever a resource is shared outside the zone of trust (IAM Access Analyzer documentation (accessed 2026-05)).

Remediation — AWS CLI

# Account-level analyzer.
aws accessanalyzer create-analyzer \
  --analyzer-name account-analyzer \
  --type ACCOUNT

# Organization-level analyzer (must be run in the delegated admin account).
aws accessanalyzer create-analyzer \
  --analyzer-name org-analyzer \
  --type ORGANIZATION

Remediation — Terraform

# Terraform AWS provider ~> 5.0
resource "aws_accessanalyzer_analyzer" "account" {
  analyzer_name = "account-analyzer"
  type          = "ACCOUNT"
}

resource "aws_accessanalyzer_analyzer" "organization" {
  analyzer_name = "org-analyzer"
  type          = "ORGANIZATION"
  # Must be applied in the Organizations delegated-administrator account.
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: Organization-scoped IAM Access Analyzer surfacing external access findings.
Resources:
  OrgAccessAnalyzer:
    Type: AWS::AccessAnalyzer::Analyzer
    Properties:
      AnalyzerName: org-external-access
      Type: ORGANIZATION

Compliance mapping

fields @timestamp, detail.resource, detail.resourceType, detail.condition, detail.principal, detail.status
| filter source = "aws.access-analyzer"
| filter detail.status = "ACTIVE"
| filter detail.principal.AWS = "*" or detail.condition.aws:PrincipalAccount not in [<org-account-ids>]
| sort @timestamp desc
| limit 100

Equivalent on: Azure · GCP · OCI

Generate and parse the IAM credential report on a scheduled cadence (daily or weekly) to identify IAM users whose passwords or access keys have not been used in ≥45 days; disable those credentials and reclaim unused users. CIS AWS Foundations v3.0.0 controls 1.12 and 1.13 codify the 45-day threshold. The credential report is a CSV emitted by IAM that lists, for every user, password and access-key activity timestamps — the canonical input for periodic IAM hygiene reviews (CIS Amazon Web Services Foundations Benchmark v3.0.0 — Jan 2024 release (accessed 2026-05)).

Remediation — AWS CLI

# Generate and download the credential report.
aws iam generate-credential-report
aws iam get-credential-report \
  --query 'Content' --output text \
  | base64 -d > credential-report.csv

# Find users whose access key has not been used in >=45 days.
awk -F, 'NR>1 && $11!="N/A" && $11!="" {
  cmd = "date -u -d \"" $11 "\" +%s";
  cmd | getline ts; close(cmd);
  now = systime();
  if (now - ts > 45*86400) print $1 "\t" $11
}' credential-report.csv

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Scheduled EventBridge rule + Lambda skeleton that pulls the credential report
# and emits SNS alerts for credentials unused >=45 days. Lambda source code is
# referenced as a deployment package; secrets are NOT embedded.
resource "aws_cloudwatch_event_rule" "credential_audit" {
  name                = "credential-report-audit"
  schedule_expression = "rate(7 days)"
}

resource "aws_lambda_function" "credential_audit" {
  function_name = "credential-report-audit"
  role          = aws_iam_role.credential_audit.arn
  handler       = "index.handler"
  runtime       = "python3.12"
  filename      = var.deployment_package_path
  environment {
    variables = {
      SNS_TOPIC_ARN     = aws_sns_topic.iam_alerts.arn
      STALE_DAYS        = "45"
    }
  }
}

resource "aws_cloudwatch_event_target" "credential_audit" {
  rule = aws_cloudwatch_event_rule.credential_audit.name
  arn  = aws_lambda_function.credential_audit.arn
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: AWS Config managed rule flagging IAM users whose credentials are unused beyond the threshold.
Resources:
  IamUserUnusedCredentialsCheck:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: iam-user-unused-credentials-check
      Description: Flags IAM users whose passwords or access keys are unused for >= maxCredentialUsageAge days.
      Source:
        Owner: AWS
        SourceIdentifier: IAM_USER_UNUSED_CREDENTIALS_CHECK
      InputParameters: !Sub '{"maxCredentialUsageAge":"90"}'

Compliance mapping

fields @timestamp, @message
| filter @logStream like /credential-report-audit/
| filter @message like /STALE_USER/
| parse @message /STALE_USER user=(?<user>\S+) days_idle=(?<days>\d+)/
| stats count() as occurrences, max(days) as max_idle by user
| sort max_idle desc

Equivalent on: Azure · GCP · OCI