Help Center/ Config/ User Guide/ Resource Compliance/ Built-In Policies/ Identity and Access Management/ Access Mode Check
Updated on 2025-01-20 GMT+08:00
View PDF
Share

Access Mode Check

Rule Details

Table 1 Rule details

Parameter

Description

Rule Name

iam-user-access-mode

Identifier

iam-user-access-mode

Description

If an IAM user has both console and API access enabled, this user is noncompliant.

Tag

iam

Trigger Type

Configuration change

Filter Type

iam.users

Configure Rule Parameters

None

Applicable Scenario

This rule ensures that an IAM user cannot access cloud services through both the console and APIs. There are two methods for accessing a cloud service:

  • Programmatic access: Users access cloud services by using development tools, such as APIs, CLI, and SDKs with access keys.
  • Management console access: Users access cloud services through the management console with passwords.

It is advised to not use passwords for programmatic access.

Solution

You can allow IAM users to access cloud services either using programmatic methods or through the console. Ensure that an IAM user does not have both a password and an access key.

Rule Logic

  • If an IAM user is disabled, this user is compliant.
  • If an IAM user is enabled, but is not allowed to access cloud services by using both the programmatic methods and the management console, this user is compliant.

  • If an enabled IAM user does not have both an access key and a password, this IAM user is compliant.

  • If an IAM user does not meet any of the above conditions, this user is noncompliant.