Description

An IAM User is an entity that you create in AWS. The IAM User represents the person or service that uses the IAM User to interact with AWS. The user {AwsUser} was found with permissive permissions that allows the user the ability to create access keys for a user or create/update console login credentials. An attacker may leverage this ability in order to create or update credentials for a user other than themselves, allowing them to then log in and act on behalf of that user.

• 

  Recommended Mitigation

  Review the user's policy and consider removing any of the following actions: iam:CreateLoginProfile, iam:UpdateLoginProfile, iam:CreateAccessKey