IAM user credentials: prefer federation for people and roles for workloads

What it checks

IAM user credentials: prefer federation for people and roles for workloads

Where it applies

Terraform: aws_iam_user

CloudFormation: AWS::IAM::User

How to fix it

1. For people, migrate to IAM Identity Center permission sets and configure directory or external-IdP MFA. For workloads, migrate to roles or OIDC where the client supports temporary credentials; document SES SMTP or other required long-term exceptions.
2. Migrate and verify every credential consumer before disabling IAM user passwords or keys. Protect and rotate credentials retained for documented exceptions.

Frameworks

• SOC 2 CC6.1
• SOC 2 CC6.3

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules