- Newest
- Most votes
- Most comments
Hello.
Before deleting it, I think it's a good idea to check CloudTrail etc. to see what operations the IAM user was performing.
You can check the AWS services that the IAM user was operating in the CloudTrail event history.
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events-console.html
You can delete it immediately, but why not attach the IAM policy described in the document below to the user and temporarily prevent them from doing anything?
I think you can disable it and delete it if there are no problems with the application or system.
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_manage.html#id_users_deactivating
An auto generated ID w/passw and console access, policy based on access to all resources for (is this normal) these are excerpts to make it fit "cloudtrail:GetTrail", "iam:GenerateServiceLastAccessedDetails", "iam:GetServiceLastAccessedDetails" action "s3:GetObject", "s3:ListBucket"
"arn:aws:s3:::{{cloudtrail-bucket}}", "arn:aws:s3:::{{cloudtrail-bucket}}/*" "kms:Decrypt""arn:aws:kms:{{region}}:{{account}}:key/{{key}}" "Condition": { "StringLike": { "kms:ViaService": "s3.*.amazonaws.com"
Relevant content
- asked 2 years ago
I think that if they can't be accounted for, then it's okay to delete them. But first, you need to check the IAM role attached to the users and be sure of what they are.
In addition, it's very critical to enable MFA on all accounts, - root or other IAM users.
Best practise is to avoid using
rootaccount after creating an AWS account. Only use therootaccount to create an IAM user that will serve as anadminhaving most accesses, then just stay away from the root account. You can then use the IAM users account with admin access to create other users, giving them just the permission they need.It's also best to use
IAM groupsand add the users you create to them. Attach policies to the groups and not directly to the users.If you operate several account, you can ensure compliance to these security best practices by using
AWS organizationsto group your account and set rules to enforce best practises e.t.c