title: How to disable a user's password in AWS using boto3
body: <p>I am auditing user passwords in AWS using boto3 and I'm not finding a way to accomplish the following CIS Benchmark: "Ensure credentials (with password enabled) unused for 90 days or greater are disabled."</p>
  
  <p>I have the code to pull the password age and to pull the last time the password was used, but I do not find anything to make inactive a password.</p>
  
  <p>For access keys (but not passwords), we have the following:</p>
  
  <pre><code>client = session.client('iam')
  
  ... (get user and keyid) ...
  
  last_used = client.get_access_key_last_used(AccessKeyId=keyid)
  
  ... (determine the age of the key) ...
  
  if age &gt;= 90:
  
      client.update_access_key(AccessKeyId=keyid, Status='Inactive', UserName=user)
  </code></pre>
  
  <p>Does anyone have any pointers?</p>