Skip to content

AWS access control & privilege security checks

Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.

On AWS, Black Cat runs 11 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the AWS connector needs.

Checks (11)

severity: critical Root Access Key Exists fix difficulty: easy #

Delete all access keys associated with the AWS root account

  1. Sign in to the AWS Management Console as the root user
  2. Navigate to IAM > Security credentials (top-right account menu)
  3. Under "Access keys", locate any existing root access keys
  4. Click "Delete" for each access key listed
  5. Confirm deletion in the dialog
  6. If automation requires programmatic access, create an IAM user with least-privilege permissions instead

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Unused Access Keys fix difficulty: easy #

Deactivate or delete IAM access keys that have not been used recently

  1. Navigate to IAM > Users in the AWS Console
  2. Click the user name to open the user detail page
  3. Select the "Security credentials" tab
  4. Under "Access keys", review the "Last used" column for each key
  5. For keys unused for 90+ days, click "Deactivate" or "Delete"
  6. Confirm the change and notify the user if necessary

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Old Access Keys Not Rotated fix difficulty: medium #

Rotate IAM access keys older than 90 days

  1. Navigate to IAM > Users in the AWS Console
  2. Click the user name, then select the "Security credentials" tab
  3. Under "Access keys", note the "Created" date for each key
  4. Click "Create access key" to generate a new key for the user
  5. Update the application or script that uses the old key with the new credentials
  6. Once the new key is confirmed working, click "Deactivate" then "Delete" on the old key

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Inactive IAM Users fix difficulty: medium #

Deactivate or remove IAM users who have been inactive for 90+ days

  1. Navigate to IAM > Users in the AWS Console
  2. Review the "Last activity" column to identify inactive users
  3. Click the user name, then select the "Security credentials" tab
  4. Deactivate all access keys by clicking "Deactivate" for each
  5. If the user account is no longer needed, navigate back and click "Delete user"
  6. Confirm the deletion and update any resource policies referencing the user

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Password Never Used fix difficulty: easy #

Deactivate the console login profile for IAM users who have never signed in

  1. Navigate to IAM > Users in the AWS Console
  2. Open the flagged user and select the "Security credentials" tab
  3. Click "Manage" next to "Console sign-in" and remove the password
  4. Confirm with the owning team that no automation depends on the user
  5. If the user is no longer required, delete it entirely

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: critical Overly Permissive IAM Policy fix difficulty: hard #

Replace wildcard IAM policy permissions with specific actions and resource ARNs

  1. Navigate to IAM > Policies in the AWS Console
  2. Locate the policy flagged and click its name to open it
  3. Click "Edit policy" and switch to the JSON tab
  4. Replace any "Action" wildcards (e.g. "*" or "service:*") with the specific actions required
  5. Replace any "Resource" wildcards ("*") with the specific resource ARNs needed
  6. Use IAM Access Analyzer to generate a least-privilege policy based on actual usage if available
  7. Click "Review policy", then "Save changes"

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Weak Password Policy fix difficulty: easy #

Strengthen the IAM account password policy to meet security best practices

  1. Navigate to IAM > Account settings in the AWS Console
  2. Click "Edit" next to the password policy
  3. Set minimum password length to at least 14 characters
  4. Require at least one uppercase letter, one lowercase letter, one number, and one non-alphanumeric character
  5. Enable "Prevent password reuse" and set history to at least 24 passwords
  6. Set maximum password age to 90 days or fewer
  7. Click "Save changes"

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Password Policy Expiration Too Long fix difficulty: easy #

Reduce maximum password age to 90 days or fewer

  1. Navigate to IAM > Account settings in the AWS Console
  2. Click "Edit" next to the password policy
  3. Set "Maximum password age" to 90 or a smaller number of days
  4. Click "Save changes"

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high SCP Not Attached to Root fix difficulty: easy #

Attach at least one SCP to the organizational root to enforce root-level guardrails

  1. Navigate to AWS Organizations > Policies > Service control policies
  2. Select the SCP that should define organization-wide guardrails
  3. Click "Attach" and choose the organizational root
  4. Verify the Organization root has at least one SCP attached

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium SCP Allows All Actions fix difficulty: hard #

Replace the wildcard Allow SCP with restrictive deny-based guardrails

  1. Navigate to AWS Organizations > Policies > Service control policies
  2. Select the flagged SCP and click "Edit"
  3. Remove the "Allow *" statement (default FullAWSAccess)
  4. Replace with explicit Deny statements for risky actions
  5. Test in a sandbox OU before applying to production

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium SCP Overly Broad Deny Exception fix difficulty: hard #

Narrow the NotAction exception list in the SCP Deny statement

  1. Navigate to AWS Organizations > Policies > Service control policies
  2. Select the flagged SCP and click "Edit"
  3. Review the Deny statement's NotAction list
  4. Remove wildcards and reduce to specific required actions
  5. Test with Access Analyzer before deploying

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

More AWS checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial