2

I have a user which, when asked to create an IAM root user account, left the now disabled root key on the instance.

When asked to remove the root key, he said it's disabled now so what's the difference.

I don't want to get into a argument with this guy but was wondering if the community had any cogent thoughts about the impact of leaving a root key on the system when it's disabled?

Thanks!

Improve this question

1 Answer 1

Reset to default
1

I'm assuming, you mean an IAM user with admin permissions for the AWS account and not the actual root user (owner) of the account.

In AWS IAM there is a difference between disabling and deleting access keys. You can disable/deactivate or delete them.

Deletion is final and you'll have to create a new set of keys. The old ones cannot be used anymore and they cannot be recreated.

Disabling/Deactivating keys basically means suspending their usage. They can be reactivated and then used again. If they've been compromised in the mean time, then you'll have active compromised keys. This is a problem.

How secure that EC2 instance is, is another matter. But it certainly is not recommended practice to use access keys on an EC2 instance, especially not keys with such large permissions attached. You should create a dedicated role for the instance and assign permissions to the role with least privileges.

Relevant AWS best practices

Improve this answer
3
  • Thanks for the reply. I understand the difference between disabling and deleting. The question is: if a disabled key is left on the system, what is the security impact? Could an adversary do anything with that key? Would they learn anything useful from it? Thanks!
    – MGoBlue93
    Jan 16, 2019 at 21:48
  • As long as the key is disabled an attacker could not use it. The keys all have the same format: AccessKeyID, SecretAccessKey; Long alphanumeric strings. There is nothing to learn from that. If you use a shared credentials file (e.g. in ~/.aws) and use profiles in there, then an attacker could learn about user and role names. That would be unfortunate but not really a problem.
    – jtepe
    Jan 17, 2019 at 6:19
  • Thanks... not trying to be difficult here but if there's nothing to learn from that, then why does docs.aws.amazon.com/general/latest/gr/… recommend removing it? I guess I need to understand what is in the key (and cannot find that info readily). By way of comparison, I've gotten keys off of web servers before and deserailized them to get the credentials... with that experience in mind, that's why I'm asking. Thanks again!
    – MGoBlue93
    Jan 17, 2019 at 18:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .