The security team is inventorying IAM user passwords, access keys, and MFA status.
It needs to identify unused credentials.
Which capability is primarily appropriate?
An IAM credential report lists the status of IAM user passwords, access keys, and MFA for account-wide review.
Detailed explanation
Shield is a DDoS protection service and does not inventory or delete IAM credentials.
Shield is a DDoS protection service and does not inventory or delete IAM credentials.
Artifact provides AWS compliance documents, not customer-account credential inventories.
Artifact provides AWS compliance documents, not customer-account credential inventories.
CloudWatch metrics are not the account-wide IAM credential inventory mechanism.
CloudWatch metrics are not the account-wide IAM credential inventory mechanism.
The credential report provides a user-by-user inventory of password, access-key, and MFA status.
The credential report provides a user-by-user inventory of password, access-key, and MFA status.
Check official documentation
Compare the following points with the official documentation.
IAM User Guideのcredential reportの説明を確認する。レポートには認証情報の状態が含まれるため、取り扱いに注意する。
What to confirm
IAMユーザーごとのパスワード、アクセスキー、MFAなどの状態を確認できる。
Key points
- Credential report
- Credential inventory
- MFA status
Notes
- Environment: AWS公式IAMドキュメントの確認
- Confirm current IAM capabilities and recommended practices in the official AWS documentation.
Foundation review
Credential inventory
A report reveals stale or missing controls that need follow-up.
Follow-up action
After review, disable unused credentials and improve MFA or rotation practices.