How do I identify when an IAM access key was last used?

Resolution

To get usage information for an access key, use the AWS Command Line Interface (AWS CLI) or AWS CloudTrail event history. You can also use credential reports and notifications to monitor IAM access keys.

Note: If you receive errors when you run AWS CLI commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Use the AWS CLI

Run the get-access-key-last-used command:

aws iam get-access-key-last-used --access-key-id ASIAIOSFODNN7EXAMPLE

Note: Replace ASIAIOSFODNN7EXAMPLE with your access key ID.

The output includes the date and time when the access key was last used, the AWS service, and the AWS Region.

Use CloudTrail event history

Complete the following steps:

1. Open the CloudTrail console, and then choose Event history.
2. In the Lookup attributes menu, choose AWS access key.
3. In the AWS access key search bar, enter the access key ID.
4. In Filter by data and time, enter the time range, and then choose Apply.

The output includes the date and time when the access key was last used, the AWS service, and the Region.

Note: The CloudTrail event history only keeps the last 90 days of data.

Amazon S3 service API calls

You might see an Amazon Simple Storage Service (Amazon S3) service call without an Amazon S3 API call from the same time in the CloudTrail event history logs. If so, then this usage was an Amazon S3 data event, not a management event. These events are part of the normal operation of Amazon S3.

Use credential reports and notifications to monitor IAM access keys

Generate a credentials report that lists all AWS accounts that include IAM access keys.

To set up notifications, see How can I set up alerts to see when an IAM access key is used?

To monitor IAM access keys, see How can I monitor the account activity of specific IAM users, roles, and AWS access keys?

Related information

Why is my Amazon EC2 instance using IAM user credentials instead of role credentials?

Finding unused access keys