AWS_HAS_ACCESS_KEY

Copy page

Summary


Forestall ACL Alias	AWS_HAS_ACCESS_KEY
Edge Type	Relationship
Affected Object Types	IAM Users, Access Keys
Exploitation Certainty	Unlikely
AWS IAM Action / Condition	Relationship visibility via `iam:ListAccessKeys`; key usage context via `iam:GetAccessKeyLastUsed`

Description

AWS_HAS_ACCESS_KEY means an IAM user has one or more long-term API access keys.

This is a credential-surface edge, not an exploit primitive. It matters for exposure and persistence analysis: long-term keys can be abused if they are leaked, left active too long, or not rotated.

Pair it with AWS_CREATE_ACCESS_KEY and AWS_DELETE_ACCESS_KEY to get the full credential lifecycle picture.

Identification

AWS CLI

List keys for one user:

aws iam list-access-keys --user-name TargetUser

Get last-used context for a key:

aws iam get-access-key-last-used --access-key-id AKIAEXAMPLEKEYID

Enumerate all users with keys:

for u in $(aws iam list-users --query 'Users[].UserName' --output text); do
  aws iam list-access-keys --user-name "$u" \
    --query "AccessKeyMetadata[].{User:'$u',AccessKeyId:AccessKeyId,Status:Status,CreateDate:CreateDate}" \
    --output table
done

Exploitation

This edge has no exploit path of its own. The credential just exists. Whether it is dangerous depends on whether the key has been compromised, or whether an attacker has the ability to replace or manage it.

Mitigation

Remove unused access keys and disable inactive keys quickly.
Enforce rotation and key age thresholds.
Prefer temporary credentials from roles instead of long-term user keys.
Alert on old active keys and high-risk usage locations.

Detection

Monitor CloudTrail for lifecycle events:

CreateAccessKey
UpdateAccessKey
DeleteAccessKey

Also track API usage by key ID against a known baseline to catch anomalous activity.

Ask AI