Why IAM Is the Highest-Risk SOC 2 Control Area

In nearly every SOC 2 audit involving AWS, IAM findings are the most common. Not because IAM is hard to configure — it's because AWS accounts accumulate technical debt: old users with stale permissions, access keys that never rotate, and admin roles granted "temporarily" years ago that are still active.

Your auditor will test IAM directly. Here's exactly what they check and how to pass.

1. MFA on All Privileged Accounts

What auditors check: Every IAM user with console access, especially those with AdministratorAccess or any policy allowing destructive actions, must have MFA enabled.

How to enforce it:

{
  "Effect": "Deny",
  "NotAction": [
    "iam:CreateVirtualMFADevice",
    "iam:EnableMFADevice",
    "iam:GetUser",
    "iam:ListMFADevices",
    "iam:ListVirtualMFADevices",
    "iam:ResyncMFADevice",
    "sts:GetSessionToken"
  ],
  "Resource": "*",
  "Condition": {
    "BoolIfExists": {"aws:MultiFactorAuthPresent": "false"}
  }
}

Attach this as an IAM policy to all non-root users to deny any action when MFA is not present.

SecureSpect check: aws.iam.mfa_privileged_users — flags any IAM user with console access and no MFA device enrolled.

2. Root Account Protection

What auditors check: The root account should have MFA, should not have active access keys, and should not be used for routine operations.

Required actions:

• Enable virtual or hardware MFA on the root account
• Delete any root access keys — they should never exist
• Enable CloudTrail to log root account usage

SecureSpect check: aws.iam.root_mfa and aws.iam.root_access_keys.

3. Access Key Rotation

What auditors check: Any active access key older than 90 days is typically a finding. Most auditors use 90 days as the threshold.

How to manage rotation:

• Use IAM Roles instead of access keys wherever possible (EC2 instance roles, Lambda execution roles, ECS task roles)
• For programmatic access that genuinely requires keys: rotate every 90 days, automate with AWS Secrets Manager rotation
• Delete access keys for deprovisioned users immediately

How to find stale keys:

aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d

The credential report shows each key's age and last-used date.

SecureSpect check: aws.iam.access_key_rotation — flags any access key older than 90 days.

4. Inactive User Cleanup

What auditors check: IAM users who haven't logged in or used their access keys in 90+ days should be deactivated or deleted.

Common finding: Former employees, contractor accounts, or "service users" that were never cleaned up.

Remediation process:

Run the credential report to identify inactive users

Disable rather than immediately delete (gives you a recovery window)

Establish a quarterly access review process — document it, evidence it

SecureSpect check: aws.iam.inactive_users — flags users with no activity in 90+ days.

5. Permission Boundaries and Least Privilege

What auditors check: No user or role should have broader permissions than required for their function.

Practical steps:

• Audit actual permissions used vs. permissions granted with AWS Access Analyzer
• Use IAM Access Analyzer to generate least-privilege policies based on CloudTrail activity
• Apply Permission Boundaries to prevent privilege escalation
• Review all *:* (wildcard action, wildcard resource) policies

AWS IAM Access Analyzer command:

aws accessanalyzer create-policy-generation \
  --policy-generation-details '{"principalArn":"arn:aws:iam::ACCOUNT:user/username"}' \
  --cloud-trail-details '{"trailArn":"arn:aws:cloudtrail:REGION:ACCOUNT:trail/trail-name","startTime":"2026-01-01T00:00:00Z","endTime":"2026-09-01T00:00:00Z","accessRole":"arn:aws:iam::ACCOUNT:role/AccessAnalyzerRole"}'

6. Service Control Policies (SCPs) in AWS Organizations

If you run multiple AWS accounts under AWS Organizations, SCPs provide an additional guardrail layer that applies regardless of individual account IAM policies.

Recommended SCPs for SOC 2:

• Deny creation of IAM users (enforce SSO/Identity Center instead)
• Deny disabling CloudTrail
• Deny removal of MFA from root
• Deny GuardDuty detector deletion

Audit-Ready Checklist

|---|---|---|