Using IAM Credential Report to Find and Disable Inactive Users
A security engineer notices that an IAM user has been inactive for 90 days. What is the best way to identify and disable such users?
Quick Answer
The answer is to use the IAM Credential Report to identify and disable inactive IAM users. This report generates a CSV file containing critical columns like `password_last_used` and `access_key_last_used_date`, which directly show the last time a user authenticated or used their access keys, making it the most accurate native method to find users with no activity for 90 days. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your ability to audit user credentials efficiently without third-party tools, and a common trap is to suggest CloudTrail or Config rules, which are overkill for a simple user-level inactivity check. The key distinction is that the Credential Report is purpose-built for this exact task—it aggregates all user activity in one export. Memory tip: think of the Credential Report as your "inactivity radar" for both passwords and keys, giving you a single CSV snapshot to spot and disable stale accounts.
⚠ Common exam trap
It's easy for candidates to confuse CloudTrail (which logs events) with the IAM Credential Report (which directly reports user activity), or they assume AWS Config can evaluate user inactivity when it is designed for resource configuration compliance, not behavioral monitoring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use IAM Credential Report and disable users with no activity in 90 days
The IAM Credential Report provides a comprehensive CSV export of all IAM users in the account, including the `password_last_used` and `access_key_last_used_date` columns. This allows a security engineer to directly identify users who have had no activity for 90 days and then disable them by applying an IAM policy with a `Deny` effect or removing their credentials. It is the most straightforward, native, and accurate method for this specific task.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use CloudTrail to identify users with no recent events
Why it's wrong here
CloudTrail records API activity but provides no built-in inactivity detection or automatic disabling; querying it manually is not the managed mechanism. CloudTrail is the correct choice when you need an audit trail of who performed which API call and when.
- ✗
Use AWS Config rule to detect inactive users
Why it's wrong here
AWS Config evaluates resource configuration compliance, and no managed rule detects IAM user inactivity based on last-used data. Config is correct when you must continuously assess whether resources match desired configuration states, such as checking that MFA is enabled.
- ✓
Use IAM Credential Report and disable users with no activity in 90 days
Why this is correct
The IAM Credential Report lists every user's password and access key usage with timestamps, letting the engineer identify accounts with no activity for 90 days and then disable them. It provides the credential-age and last-used data the scenario requires.
- ✗
Use AWS Organizations to disable users
Why it's wrong here
AWS Organizations manages accounts and service control policies, not individual IAM users; it cannot identify or disable a user. It is the right tool for centrally governing multiple accounts, such as applying SCPs across an organisation, not for per-user credential lifecycle actions.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer notices that an IAM user has been performing suspicious actions in an AWS account. The engineer needs to generate a credential report to identify the age of the user's access keys. Which AWS CLI command should the engineer run?
hard- A.aws iam get-account-authorization-details
- ✓ B.aws iam generate-credential-report && aws iam get-credential-report
- C.aws iam generate-service-last-accessed-details
- D.aws iam list-access-keys --user-name suspectUser
Why B: The AWS CLI command to generate and retrieve an IAM credential report is a two-step process: first run 'aws iam generate-credential-report' to trigger report generation, then run 'aws iam get-credential-report' to retrieve it. The report includes access key age, password age, MFA status, and other credential metadata for all IAM users, which is exactly what the engineer needs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.