Find IAM Access Keys Older Than 90 Days or Never Used

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListAllUsers",
      "Effect": "Allow",
      "Action": "iam:ListUsers",
      "Resource": "*"
    },
    {
      "Sid": "ReadAccessKeys",
      "Effect": "Allow",
      "Action": ["iam:ListAccessKeys", "iam:GetAccessKeyLastUsed"],
      "Resource": "arn:aws:iam::123456789012:user/*"
    },
    {
      "Sid": "OptionalDeactivate",
      "Effect": "Allow",
      "Action": "iam:UpdateAccessKey",
      "Resource": "arn:aws:iam::123456789012:user/*"
    }
  ]
}

// find-old-iam-access-keys.ts
// Reports IAM user access keys that are older than --max-age days or not used
// for --unused days (including keys never used). Read-only by default.
// With --deactivate it shows which Active keys it would set to Inactive (dry run);
// add --apply to make the change. Keys are never deleted.
// Usage: npx tsx find-old-iam-access-keys.ts [--max-age 90] [--unused 45] [--deactivate [--apply]]
import {
  IAMClient,
  GetAccessKeyLastUsedCommand,
  UpdateAccessKeyCommand,
  paginateListUsers,
  paginateListAccessKeys,
} from "@aws-sdk/client-iam";

const DAY = 86_400_000;

function numberArg(name: string, fallback: number): number {
  const i = process.argv.indexOf(name);
  const value = i > -1 ? Number(process.argv[i + 1]) : fallback;
  if (!Number.isFinite(value) || value < 1) throw new Error(`${name} must be a positive number`);
  return value;
}

const maxAgeDays = numberArg("--max-age", 90);
const unusedDays = numberArg("--unused", 45);
const deactivate = process.argv.includes("--deactivate");
const apply = process.argv.includes("--apply");

const iam = new IAMClient({
  region: process.env.AWS_REGION ?? "us-east-1",
  maxAttempts: 8,
  retryMode: "adaptive",
});

type Finding = {
  user: string;
  keyId: string;
  status: string;
  ageDays: number;
  lastUsed: string;
  lastService: string;
  reasons: string;
};

async function main(): Promise<void> {
  // Never deactivate the key this script is signing requests with.
  const ownKeyId = (await iam.config.credentials()).accessKeyId;
  const now = Date.now();
  const findings: Finding[] = [];
  let keysChecked = 0;

  for await (const page of paginateListUsers({ client: iam }, {})) {
    for (const user of page.Users ?? []) {
      if (!user.UserName) continue;
      const keys = paginateListAccessKeys({ client: iam }, { UserName: user.UserName });
      for await (const keyPage of keys) {
        for (const key of keyPage.AccessKeyMetadata ?? []) {
          if (!key.AccessKeyId || !key.CreateDate) continue;
          keysChecked++;
          const { AccessKeyLastUsed: used } = await iam.send(
            new GetAccessKeyLastUsedCommand({ AccessKeyId: key.AccessKeyId }),
          );
          const ageDays = Math.floor((now - key.CreateDate.getTime()) / DAY);
          const lastUsed = used?.LastUsedDate;
          const idleDays = lastUsed ? Math.floor((now - lastUsed.getTime()) / DAY) : ageDays;

          const reasons: string[] = [];
          if (ageDays > maxAgeDays) reasons.push(`older than ${maxAgeDays}d`);
          if (!lastUsed && ageDays > unusedDays) reasons.push("never used");
          else if (lastUsed && idleDays > unusedDays) reasons.push(`unused ${idleDays}d`);
          if (reasons.length === 0) continue;

          findings.push({
            user: user.UserName,
            keyId: key.AccessKeyId,
            status: key.Status ?? "unknown",
            ageDays,
            lastUsed: lastUsed?.toISOString().slice(0, 10) ?? "never",
            lastService: used?.ServiceName ?? "N/A",
            reasons: reasons.join(", "),
          });
        }
      }
    }
  }

  console.table(findings);
  console.log(`${keysChecked} access keys checked, ${findings.length} flagged.`);
  if (!deactivate) return;

  const targets = findings.filter((f) => f.status === "Active" && f.keyId !== ownKeyId);
  console.log(`\n${apply ? "Deactivating" : "Dry run: would deactivate"} ${targets.length} active keys:`);
  for (const f of targets) {
    console.log(`  ${f.user}  ${f.keyId}  (${f.reasons})`);
    if (!apply) continue;
    await iam.send(new UpdateAccessKeyCommand({ UserName: f.user, AccessKeyId: f.keyId, Status: "Inactive" }));
  }
  if (!apply && targets.length > 0) console.log("Re-run with --deactivate --apply to make the change.");
}

main().catch((err: unknown) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-iam
npm install --save-dev tsx typescript

# Report only (defaults: older than 90 days, unused for 45)
AWS_PROFILE=security-audit npx tsx find-old-iam-access-keys.ts

# Stricter thresholds
AWS_PROFILE=security-audit npx tsx find-old-iam-access-keys.ts --max-age 60 --unused 30

# Dry run: show which active keys would be deactivated
AWS_PROFILE=iam-admin npx tsx find-old-iam-access-keys.ts --deactivate

# Make the change
AWS_PROFILE=iam-admin npx tsx find-old-iam-access-keys.ts --deactivate --apply

┌─────────┬──────────────┬────────────────────────┬──────────┬─────────┬──────────────┬─────────────┬──────────────────────────────────┐
│ (index) │ user         │ keyId                  │ status   │ ageDays │ lastUsed     │ lastService │ reasons                          │
├─────────┼──────────────┼────────────────────────┼──────────┼─────────┼──────────────┼─────────────┼──────────────────────────────────┤
│ 0       │ 'ci-deploy'  │ 'AKIAIOSFODNN7EXAMPLE' │ 'Active' │ 412     │ '2026-09-26' │ 's3'        │ 'older than 90d'                 │
│ 1       │ 'backup-old' │ 'AKIAI44QH8DHBEXAMPLE' │ 'Active' │ 730     │ '2025-03-02' │ 'ec2'       │ 'older than 90d, unused 574d'    │
│ 2       │ 'jsmith'     │ 'AKIAJ5ZRZWPEXAMPLE22' │ 'Active' │ 120     │ 'never'      │ 'N/A'       │ 'older than 90d, never used'     │
└─────────┴──────────────┴────────────────────────┴──────────┴─────────┴──────────────┴─────────────┴──────────────────────────────────┘
27 access keys checked, 3 flagged.

Dry run: would deactivate 3 active keys:
  ci-deploy  AKIAIOSFODNN7EXAMPLE  (older than 90d)
  backup-old  AKIAI44QH8DHBEXAMPLE  (older than 90d, unused 574d)
  jsmith  AKIAJ5ZRZWPEXAMPLE22  (older than 90d, never used)
Re-run with --deactivate --apply to make the change.