> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_has_access_key.md).

# AWS\_HAS\_ACCESS\_KEY

## Summary

|                                |                                                                                                    |
| ------------------------------ | -------------------------------------------------------------------------------------------------- |
| **Forestall ACL Alias**        | AWS\_HAS\_ACCESS\_KEY                                                                              |
| **Edge Type**                  | Relationship                                                                                       |
| **Affected Object Types**      | IAM Users, Access Keys                                                                             |
| **Exploitation Certainty**     | Unlikely                                                                                           |
| **AWS IAM Action / Condition** | Relationship visibility via `iam:ListAccessKeys`; key usage context via `iam:GetAccessKeyLastUsed` |

## Description

`AWS_HAS_ACCESS_KEY` means an IAM user has one or more long-term API access keys.

This is a credential-surface edge, not an exploit primitive. It matters for exposure and persistence analysis: long-term keys can be abused if they are leaked, left active too long, or not rotated.

Pair it with [`AWS_CREATE_ACCESS_KEY`](https://docs.forestall.io/fsprotect/edges/aws/aws_create_access_key) and [`AWS_DELETE_ACCESS_KEY`](https://docs.forestall.io/fsprotect/edges/aws/aws_delete_access_key) to get the full credential lifecycle picture.

## Identification

### AWS CLI

List keys for one user:

```bash
aws iam list-access-keys --user-name TargetUser
```

Get last-used context for a key:

```bash
aws iam get-access-key-last-used --access-key-id AKIAEXAMPLEKEYID
```

Enumerate all users with keys:

```bash
for u in $(aws iam list-users --query 'Users[].UserName' --output text); do
  aws iam list-access-keys --user-name "$u" \
    --query "AccessKeyMetadata[].{User:'$u',AccessKeyId:AccessKeyId,Status:Status,CreateDate:CreateDate}" \
    --output table
done
```

### AWS Console

* Open **IAM** -> **Users** -> select user.
* Open **Security credentials**.
* Review access key IDs, status, and age.

## Exploitation

This edge has no exploit path of its own. The credential just exists. Whether it is dangerous depends on whether the key has been compromised, or whether an attacker has the ability to replace or manage it.

## Mitigation

* Remove unused access keys and disable inactive keys quickly.
* Enforce rotation and key age thresholds.
* Prefer temporary credentials from roles instead of long-term user keys.
* Alert on old active keys and high-risk usage locations.

## Detection

Monitor CloudTrail for lifecycle events:

* `CreateAccessKey`
* `UpdateAccessKey`
* `DeleteAccessKey`

Also track API usage by key ID against a known baseline to catch anomalous activity.

## References

* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAccessKeys.html>
* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccessKeyLastUsed.html>
* <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html>