How to revoke an IAM user immediately

Topic: Accounts access

Revoke all access for an IAM user without deleting the user: deactivate console password, delete all access keys, and detach MFA. Use this when someone leaves or credentials are compromised; optionally delete the user after revoking.

Intent: How-to

Quick answer

  • Delete every access key for the user so CLI and API access stop immediately; use list-access-keys and delete-access-key for each key.
  • Deactivate or delete the console password so the user cannot sign in to the console; remove MFA device if you are cleaning up the identity.
  • Optionally detach all policies and remove from groups; delete the user once you have confirmed no resources (e.g. owned objects) need the user ARN.

Prerequisites

Steps

  1. Delete all access keys

    List access keys for the user and delete each one with delete-access-key; this revokes programmatic access immediately.

  2. Block console sign-in

    Use delete-login-profile to remove the console password, or create a Deny policy that blocks all actions; the user can no longer sign in to the console.

  3. Remove MFA and optional cleanup

    Deactivate MFA device for the user (console or API) so the identity cannot be used; detach all policies and remove user from all groups if you plan to delete the user.

  4. Delete the user (optional)

    After confirming no resources reference the user (e.g. S3 bucket owner, resource tags), delete the user with delete-user; ensure access keys and login profile are already removed.

Summary

You will revoke an IAM user’s access immediately by deleting all access keys, removing console sign-in, and optionally removing MFA and deleting the user. Use this when an operator leaves or when you suspect compromise; for SSO, see revoking federated access.

Prerequisites

  • You have IAM permissions to manage the user: iam:DeleteAccessKey, iam:DeleteLoginProfile, iam:DeleteUser, iam:DetachUserPolicy, iam:RemoveUserFromGroup, and similar.
  • You know the IAM user name to revoke.

Steps

Step 1: Delete all access keys

USER=username-to-revoke
for key in $(aws iam list-access-keys --user-name "$USER" --query 'AccessKeyMetadata[].AccessKeyId' --output text); do
  aws iam delete-access-key --user-name "$USER" --access-key-id "$key"
done

Console: IAM → Users → select user → Security credentials → Access keys → Delete each key. Programmatic access is revoked as soon as the keys are deleted.

Step 2: Block console sign-in

aws iam delete-login-profile --user-name "$USER"

If the user has a console password, this removes it so they cannot sign in to the console. If you prefer to keep the user but block all actions, attach an explicit Deny policy that overrides other permissions (use sparingly and document).

Step 3: Remove MFA and optional cleanup

  • MFA: In the console, IAM → Users → user → Security credentials → MFA → Deactivate. There is no direct “delete MFA” API; removing the login profile and keys effectively revokes access. For full cleanup, deactivate the MFA device in the console.
  • Policies and groups: To prepare for user deletion, detach all managed policies and remove the user from all groups:
for policy in $(aws iam list-attached-user-policies --user-name "$USER" --query 'AttachedPolicies[].PolicyArn' --output text); do
  aws iam detach-user-policy --user-name "$USER" --policy-arn "$policy"
done
for group in $(aws iam list-groups-for-user --user-name "$USER" --query 'Groups[].GroupName' --output text); do
  aws iam remove-user-from-group --user-name "$USER" --group-name "$group"
done

Step 4: Delete the user (optional)

aws iam delete-user --user-name "$USER"

Only run this after access keys and login profile are removed and you have confirmed no resources (e.g. S3 bucket owner, resource tags, or other references) require the user ARN. If deletion fails, fix the dependency (e.g. transfer bucket ownership) and retry.

Verification

  • aws iam list-access-keys --user-name "$USER" returns no keys (or “NoSuchEntity” if user was deleted).
  • User cannot sign in to the console (login profile deleted or user deleted).
  • CloudTrail shows the revoke and delete actions for audit.

Troubleshooting

Cannot delete access key — Ensure you are using the correct user name and key ID; you need iam:DeleteAccessKey. If the key is already deleted, the error may be from a stale reference.

Delete user fails: entity in use — Something references the user (e.g. inline policy, group membership, or resource). List attached policies and groups, remove them, then check for bucket ownership or other resource references before deleting again.

Need to preserve audit trail — Revoke access (keys and login profile) but keep the user and leave an explicit Deny policy attached with a note; delete the user after your retention period if policy allows.

Next steps

Continue to