AWS IAM User
Does ZopNight manage AWS IAM User?
An IAM user can hold a console password and up to two access keys. RC-082 fires when the oldest active key passes 90 days, and RC-083 fires on a missing MFA device but only for users with console access, so programmatic-only users are never flagged for a control they cannot use.
Rules that fire on AWS IAM User
At a glance
| Field | Value |
|---|---|
| Scheduling notes | discovery and compliance posture only. |
An IAM user is a long-lived identity that can carry a console password and as many as two access keys. The keys are the part that matters, because they routinely outlive whoever asked for them.
Keys outlive the reason they were created
A key issued for a laptop, a build agent, or a contractor stays valid until somebody rotates or deletes it. Nothing expires on its own. That is the whole risk model for this resource type: not that a user costs money, because none of this bills, but that a credential created for a temporary purpose remains a permanent way in. Users are also the identity type most likely to be shared, which makes attribution after an incident harder than it should be.
Ninety days, measured on the oldest active key
RC-082 IAM User Access Key Older Than 90 Days reads the age of the user’s oldest active key, recorded during discovery, and fires past 90 days. Ninety is the interval AWS and NIST guidance both settle on for rotation. Measuring the oldest active key rather than the newest is the strict reading: a user who rotated one key last week and left a three-year-old key active has not rotated anything in any meaningful sense.
MFA is checked where a human can sign in
RC-083 IAM User Without MFA Enabled is rated high and gated on console access. A user with no console password cannot use a virtual MFA device at sign-in, so flagging it would produce a finding with no remedy. The rule therefore requires both signals: console access present, MFA device absent. Programmatic-only users fall outside it by design, and the right control for those is key rotation, which the previous rule covers.
Both flags come from discovery, not from tags
Each rule reads state the IAM discovery pass recorded, never a customer tag. That distinction matters more than it looks: a tag is user-controlled text that nothing guarantees, and gating a security rule on one produces a rule that silently never fires. Both rules also fail closed when their flag is missing, so an unmeasured user raises no finding.
Where to start on a large account
The account credential report is the fastest first pass, because it lists every user alongside key ages and MFA status in one place. Discovery reads the same underlying facts through the user listing, access key listing, MFA device listing, and login profile lookups.