AWS IAM medium security documentation change
Summary
Added clarification note about limitations of IAM credential reports regarding service-specific credentials and access keys beyond the first two per user
Security assessment
The change explicitly documents security visibility limitations in credential reports, which could lead to security oversights if misunderstood. By clarifying that service-specific credentials and additional access keys aren't included, it addresses potential security gaps in credential management awareness. The added API references help mitigate security risks through better credential monitoring.
Diff
diff --git a/IAM/latest/UserGuide/id_credentials_getting-report.md b/IAM/latest/UserGuide/id_credentials_getting-report.md index 708007849..9cafa57a4 100644 --- a//IAM/latest/UserGuide/id_credentials_getting-report.md +++ b//IAM/latest/UserGuide/id_credentials_getting-report.md @@ -10,0 +11,4 @@ You can generate and download a _credential report_ that lists all users in your +###### Note + +The IAM credential report only includes the following IAM-managed credentials: passwords, the first two access keys per user, MFA devices, and X.509 signing certificates. The report does not include service-specific credentials (such as CodeCommit passwords or Amazon Bedrock long-term API keys) or any other user access keys beyond the first two. For complete credential visibility, use the [ListServiceSpecificCredentials](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListServiceSpecificCredentials.html) and [ListAccessKeys](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAccessKeys.html) APIs. +