We previously had some AWS keys. The IAM interface show/showed no usage for it but the employee has been able to upload resources. Could anyone advise how to check if the interface is just erring or if they were perhaps not using these credentials?
The ATHENA Queries i was tried
SELECT eventTime, eventName, userIdentity.principalId,eventSource FROM athena-table WHERE useridentity.accesskeyid like 'AKIAIOSFODNN7EXAMPLE' SELECT * FROM athena-table WHERE useridentity.type = 'IAMUser' AND useridentity.username LIKE 'Alice';
After investigating the credential report and when I dig into CloudTrail logs to find out when/where the key is being used I’m not getting so much help with the Last activity of user output
In the IAM Console, the Last activity is shown as Never for that particular user, but how is that user using the account without logging then. What is your best advice on it?
We'll be deleting that user but prior to doing that I wanted to see how she was using the account without logging in. Is there a better way to find out this?