Secret unused for more than 90 days

What's the problem

The secret has not been accessed for more than 90 days (or never, and was created more than 90 days ago). Anyone who kept access can still read it, and each secret costs $0.40/month

How 6WAF detects it

• Deterministic checks through AWS API calls (IAM, S3, EC2/VPC, CloudTrail, KMS, Secrets Manager, ACM, detection services) — no LLM is used for detection; severity is the value the scanner assigns, shown above.
• Scanning uses an IAM Role you deploy yourself via CloudFormation; 6WAF stores no credentials and you revoke access any time by deleting the stack.
• Automated scoring covers only part of the scope of standards such as ISO 27001 — this is a technical assessment, not a certification.