IAM-AccessKeys-Older-90-Days.yml

policies:

  - name: IAM-AccessKeys-Older-90-Days
    comment: Checks if exists some Access Key older than 90 days
    resource: aws.iam-user
    filters:
      - type: access-key
        key: Status
        value: Active
      - type: access-key
        match-operator: and
        key: CreateDate
        value_type: age
        op: greater-than
        value: 90
    actions:
      - type: notify
        to:
          - event-user
        transport:
          type: sqs
          queue: YOUR-SQS-ARN