Skip to content
FedRAMP Rules Hub
JSON — GET /api/aws-evidence

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Control index

The mechanism that ends a temporary or emergency account without anyone deciding to: the AWS Config rule that measures how long an IAM credential has gone unused, the period it is configured with, the remediation configuration proving the revocation fires automatically, and an empty non-compliant set showing nothing has outlived the period

JSON — GET /api/aws-evidenceMD — /collect/temporary-account-automatic-revocation.md — this page as markdown, for pasting into an agent

The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.

partial — needs judgementconfig-rulecontinuousAWS ConfigAWS IAMAWS Systems Manager Automation

Fetch

$ aws configservice describe-config-rules --config-rule-names iam-user-unused-credentials-check
$ aws configservice get-compliance-details-by-config-rule --config-rule-name iam-user-unused-credentials-check --compliance-types NON_COMPLIANT
$ aws configservice describe-remediation-configurations --config-rule-names iam-user-unused-credentials-check
$ aws iam get-account-authorization-details --filter User

Expected output

The four responses are collected unprojected, so every field below is the name AWS returns and the name the assertions address. From describe-config-rules, ConfigRules[] with one entry: Source.SourceIdentifier IAM_USER_UNUSED_CREDENTIALS_CHECK, ConfigRuleState ACTIVE, and InputParameters as a JSON-formatted STRING (not an object) that must be parsed before maxCredentialUsageAge can be read from it — an int, a number of DAYS, defaulting to 90. From get-compliance-details-by-config-rule, an EvaluationResults array whose every entry is one IAM user still holding a password or an active access key unused beyond that period; empty is the passing shape. From describe-remediation-configurations, RemediationConfigurations[] — a list whose minimum length is ZERO, so a rule with no remediation attached returns an empty array rather than an error, which is why one assertion tests that the first entry exists at all before the others read Automatic, TargetType SSM_DOCUMENT and TargetId. From get-account-authorization-details, UserDetailList[] with one entry per IAM user carrying UserName, CreateDate as an ISO-8601 timestamp, and Tags as a list of key/value pairs.

Assertions — what makes it a pass

Assertions for The mechanism that ends a temporary or emergency account without anyone deciding to: the AWS Config rule that measures how long an IAM credential has gone unused, the period it is configured with, the remediation configuration proving the revocation fires automatically, and an empty non-compliant set showing nothing has outlived the period: the field checked, the condition it must satisfy, the rows it applies to, and the controls a pass proves.
FieldMust beForProves
iam-user-unused-credentials-check-rule.ConfigRules[].ConfigRuleStateeq "ACTIVE"The rule that measures credential dormancy is evaluating, not deleting or stopped.every rowAC-02 (02)
iam-user-unused-credentials-check-rule.ConfigRules[].InputParameters.maxCredentialUsageAgelte 90The configured period is no longer than the organization-defined maximum; 90 is the AWS default — substitute the shorter period if your SSP states one. InputParameters arrives as a JSON string and must be parsed before this field exists.every rowAC-02 (02)
iam-user-unused-credentials-check.EvaluationResultscount_eq 0No IAM user holds a password or an active access key that has gone unused beyond that period.every rowAC-02 (02)
iam-user-unused-credentials-check-remediation.RemediationConfigurations[0].TargetIdexistsA remediation configuration is attached to the rule at all — the list is empty when none is, and every clause below it passes vacuously over an empty list.every rowAC-02 (02)
iam-user-unused-credentials-check-remediation.RemediationConfigurations[].Automaticeq trueThe revocation fires on non-compliance without a human starting it — the word 'automatically' in the control, as a field.every rowAC-02 (02)
iam-user-unused-credentials-check-remediation.RemediationConfigurations[].TargetIdeq "AWSConfigRemediation-RevokeUnusedIAMUserCredentials"What fires is the runbook that deactivates expired access keys and deletes expired login profiles, not an alert that someone has to read.every rowAC-02 (02)
get-account-authorization-details.UserDetailList[].CreateDatemax_age_days 90No IAM user your tagging marks as temporary or emergency is older than the same organization-defined period — the still-active account the dormancy rule cannot see.Tags[?Key=='AccountType'].Value in ["temporary","emergency"]AC-02 (02)

Authored opinion, like the commands. Units live in the operator name — max-age-days is days, and nothing here is converted for you.

Map — what it proves

  • recipe1
Key Security Indicators
KSI-IAM-AAMKSI-IAM-SNU
NIST 800-53 controls
recipe · 1 recipeAC-02 (02)
  • recipe— an authored recipe collects evidence for this control
  • KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
  • orphan— no Key Security Indicator reaches it — a person writes it up instead

What else these families can fetch:AC 16/50 →

GovCloud

AWS Config and IAM_USER_UNUSED_CREDENTIALS_CHECK are available in both GovCloud (US) Regions — the rule's published exclusion list names no GovCloud Region — as is Systems Manager Automation. User and role ARNs, and the AutomationAssumeRole the runbook assumes, use partition arn:aws-us-gov. The rule reports on a global IAM resource type, so deploy it in exactly one Region: a periodic rule on a global type evaluates in every Region it is added to, and duplicating it duplicates the evaluations rather than the coverage.

Notes & assertions

AC-02 (02) asks for something narrower than it looks: not that temporary and emergency accounts are reviewed, but that they END on their own after a stated period. Most of that sentence is in this output. The period is the rule's maxCredentialUsageAge. The ending is the remediation configuration — Automatic true and TargetId AWSConfigRemediation-RevokeUnusedIAMUserCredentials, a runbook whose documented behaviour is to deactivate expired access keys and delete expired login profiles. That nothing has outlived the period is the empty NON_COMPLIANT set. A screenshot of a console page proves none of those; these four calls prove all of them. What they do not prove is the control's subject. The Config rule measures every IAM user in the account; nothing in this output says WHICH users are the temporary and emergency ones, and the control is about those. A human names that population — which is exactly why this recipe is partial and not full, and why the CreateDate assertion is written as a filter over your own tagging rather than as a claim over the account. Two scope edges to write into the assessment rather than discover during it. The rule sees IAM users, so an account whose privileges live in an assumed role or an IAM Identity Center permission set is out of its reach — those expire by session duration instead, which is a different artifact (see the IA-11 recipe). And the rule measures INACTIVITY, not age: a temporary account that is used every day is compliant no matter how long ago it should have been closed. The fourth call is what narrows that gap, by reading CreateDate against your own tagging of which accounts were meant to be temporary. That last check is only as complete as the tagging behind it, and no AWS Config rule can make it complete: REQUIRED_TAGS does not support AWS::IAM::User, so tag coverage over IAM users cannot be asserted from Config at all. Treat the tagging standard as a written control with a manual sample. Read the CreateDate assertion for what it is — a check over exactly the accounts your tagging labels, which passes without saying anything on an estate that labels none. The first remediation assertion is not redundant with the two that follow it. describe-remediation-configurations returns a list whose minimum length is zero, so a rule with NO remediation attached returns an empty array, and a clause of the form 'every entry is Automatic' is true over it. Testing that the first entry exists is what turns 'the revocation fires by itself' from a claim into a field. The 90 in the assertions is the AWS default, not a FedRAMP number. Replace it in both places with the period your SSP commits to, and keep the runbook's own MaxCredentialUsageAge parameter equal to the period of the rule that triggers it — AWS documents that discipline for the access-keys-rotated pairing (match MaxCredentialUsageAge to that rule's maxAccessKeyAge) rather than for this rule, but the failure it prevents is the same one: a mismatch means the detection window and the revocation window disagree silently. Re-evaluating the rule within 4 hours of its last evaluation returns the previous result, so collect on the rule's own cadence rather than on demand.

References

This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.

The Identity and Access Management run (16)

  • automatable
  • partial — needs judgement
  • narrative — no API proves this

Every authored recipe filed under IAM, in the order the plan works them. The mark says how much of the evidence the command produces on its own.