{
  "Categories": [],
  "CheckID": "iam_disable_90_days_credentials",
  "CheckTitle": "Ensure credentials unused for 90 days or greater are disabled",
  "CheckType": [
    "Software and Configuration Checks"
  ],
  "DependsOn": [],
  "Description": "Ensure credentials unused for 90 days or greater are disabled",
  "Notes": "",
  "Provider": "aws",
  "RelatedTo": [],
  "RelatedUrl": "",
  "Remediation": {
    "Code": {
      "CLI": "",
      "NativeIaC": "",
      "Other": "",
      "Terraform": ""
    },
    "Recommendation": {
      "Text": "Find the credentials that they were using and ensure that they are no longer operational. Ideally; you delete credentials if they are no longer needed. You can always recreate them at a later date if the need arises. At the very least; you should change the password or deactivate the access keys so that the former users no longer have access.",
      "Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_finding-unused.html"
    }
  },
  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
  "ResourceType": "AwsIamUser",
  "Risk": "AWS IAM users can access AWS resources using different types of credentials (passwords or access keys). It is recommended that all credentials that have been unused in 90 or greater days be removed or deactivated.",
  "ServiceName": "iam",
  "Severity": "medium",
  "SubServiceName": "",
  "Tags": {
    "Tag1Key": "value",
    "Tag2Key": "value"
  }
}
