What's new?

• Added the AWS > IAM > Service Specific Credential > Active > Status policy. The Active control previously judged these credentials on age alone, with no way to take account of whether a credential was still switched on in AWS. The new sub-policy reads the credential's status: set it to Active if $.Status is active to alarm on credentials that have been made inactive, or Force active if $.Status is active to keep credentials that are still active in place regardless of age.

Bug fixes

• The AWS > IAM > User > Delete action could report a successful delete and remove the user from the CMDB while the user still existed in AWS, leaving no sign in Guardrails that anything had gone wrong. This has been resolved; the user is removed from the CMDB only once AWS confirms the deletion, and a failed delete now leaves the resource in place and puts the control into an error state.
• The AWS > IAM > User > Delete action now also removes a user's SSH public keys and service specific credentials. AWS requires these to be cleared before a user can be deleted, so Enforce: Delete unapproved previously failed with Cannot delete entity, must remove referenced objects first for any user that had them.

Policy Types

Added

• AWS > IAM > Service Specific Credential > Active > Status