Severity: HighMedium
Description: This control ensures that IAM Users having active access keys and have not used for 90 days or more. It is recommended that all users access keys that have been unused in 90 or greater days be removed or deactivated. Disabling or removing unnecessary credentials will reduce the window of opportunity for credentials associated with a compromised or abandoned account to be used.
...