> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_delete_access_key.md).

# AWS\_DELETE\_ACCESS\_KEY

## Summary

|                                |                                           |
| ------------------------------ | ----------------------------------------- |
| **Forestall ACL Alias**        | AWS\_DELETE\_ACCESS\_KEY                  |
| **Edge Type**                  | Attack Path                               |
| **Affected Object Types**      | IAM Users                                 |
| **Exploitation Certainty**     | Certain                                   |
| **AWS IAM Action / Condition** | `iam:DeleteAccessKey` for target IAM user |

## Description

`AWS_DELETE_ACCESS_KEY` is the ability to delete an existing access key from an IAM user.

On its own, this can disrupt service. In an attack chain, it is used to:

* Clear a key slot when the target user already has two keys.
* Create attacker-controlled credentials via [`AWS_CREATE_ACCESS_KEY`](https://docs.forestall.io/fsprotect/edges/aws/aws_create_access_key).
* Replace legitimate credentials with attacker-managed ones for persistence.

## Identification

### AWS CLI

Check whether a principal can delete access keys for a target user:

```bash
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/AnalystUser \
  --action-names iam:DeleteAccessKey \
  --resource-arns arn:aws:iam::123456789012:user/TargetUser
```

List existing target keys:

```bash
aws iam list-access-keys --user-name TargetUser
```

### AWS Console

* Open **IAM** -> **Users** -> select target user.
* Open **Security credentials**.
* Review access keys and delegated permissions for key management.

## Exploitation

Delete an existing key:

```bash
aws iam delete-access-key \
  --user-name TargetUser \
  --access-key-id AKIAEXAMPLEKEYID
```

Common chain:

1. Delete key to free slot (`AWS_DELETE_ACCESS_KEY`).
2. Create attacker key (`AWS_CREATE_ACCESS_KEY`).

## Mitigation

* Restrict `iam:DeleteAccessKey` to dedicated identity lifecycle processes.
* Separate key deletion and key creation duties where possible.
* Alert when keys are deleted for high-value users outside approved windows.
* Require change control for IAM credential management actions.

## Detection

Monitor CloudTrail:

* **Event source**: `iam.amazonaws.com`
* **Event name**: `DeleteAccessKey`

Example lookup:

```bash
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteAccessKey
```

Correlate with `CreateAccessKey` activity on the same user within a short window.

## References

* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteAccessKey.html>
* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAccessKeys.html>
* <https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/index.html>