IAM - Attacker having knowledge of unused passwords can compromise the infrastructure

[msaindane]

Threat: Spoofing

Mitigations:

• Disable or delete accounts with passwords unused for a long time.

References: http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_finding-unused.html

[zeroXten]

Related to https://github.com/owasp-cloud-security/owasp-cloud-security/blob/master/aws/iam/aws_iam_threats.yaml#L66 but this is a different threat.