AWS access reviews: a monthly checklist

Published 2026-10-24, updated 2026-11-05

"How do you review access?" appears in Cyber Essentials, ISO 27001, SOC 2 and nearly every customer security questionnaire. For AWS, a good review takes about fifteen minutes a month. Here's a checklist.

1. List everyone who can get in

For each AWS account:

The root user: has it got MFA, and when was it last used?
IAM users: the credential report (IAM → Credential report) lists every user, whether they have a console password, active access keys, MFA, and when each was last used.
Roles other accounts can assume: check each role's trust policy for other AWS account IDs. Vendors' roles should require an external ID.
Single sign-on users: if you use IAM Identity Center, review its users and permission sets too.

To download the credential report as a spreadsheet:

aws iam generate-credential-report
aws iam get-credential-report --query Content --output text | base64 --decode > credential-report.csv

IAM Access Analyzer's external access findings show what's shared outside your account, which is a quick way to check the roles above.

2. Flag what needs a second look

Anyone not used for 90 days.
Console access without MFA.
Administrator rights, especially on IAM users rather than roles.
Access keys older than a year.
Anyone new since last month, and anyone who's left the company.

3. Decide: keep or remove

For each person or role, record keep or remove, with a short reason where it isn't obvious ("contractor until December", "CI pipeline"). The decision is the evidence; the reason saves next month's reviewer time.

4. Remove what you marked

Deactivate access keys first and delete them a week later if nothing breaks. Remove console passwords, MFA devices and group memberships, then delete the user. For a vendor role, check with the vendor before removing it.

5. Sign it off

Write down who did the review and when, and keep it. A signed, dated record each month is exactly what an assessor or a customer's security team wants to see, and it makes the next review faster.

Leavers can't wait a month

Monthly reviews catch drift; leavers need same-day action. Tie AWS access removal to your leaver process in Google Workspace or Microsoft 365, so suspending someone there also starts their AWS clean-up.