When can we get additional attributes under AWS Directory Service Data api

The AWS Directory Service Data API provides access to a specific set of directory attributes, but "Last Logon Time" and "When Created" are not explicitly listed among the available attributes in the current implementation.

The Directory Service Data API includes attributes categorized as either request attributes or other attributes. While there is a "WhenChanged" attribute available, there isn't a direct equivalent for "Last Logon Time" or "When Created" in the documented attribute list.

If you need to extend the schema of your AWS Managed Microsoft AD directory to include additional attributes, you can do so by using the schema extension process. This involves creating and uploading a valid LDIF (Lightweight Directory Interchange Format) script file that defines new attributes or modifies existing classes. However, this approach would be for extending the AD schema itself, not necessarily making those attributes available through the Directory Service Data API.

To access directory data via the Directory Service Data API, you first need to enable it using the enable_directory_data_access method in boto3, providing your directory ID. You can check the status of this enablement using the describe_directory_data_access method.

For your specific need to access "Last Logon Time" and "When Created" attributes, you might need to explore alternative approaches, such as using direct LDAP queries or PowerShell commands against your AWS Managed Microsoft AD, as these attributes may not be directly accessible through the Directory Service Data API.
Sources
Tutorial: Extending your AWS Managed Microsoft AD schema - AWS Directory Service
enable_directory_data_access - Boto3 1.38.8 documentation
AWS Directory Service Data attributes - AWS Directory Service
describe_directory_data_access - Boto3 1.37.32 documentation

Currently there is no direct API call for the task : 'Last Logon Time' and 'When Created' in AWS Directory service public APIs.

However, there is a workaround to fetch these details. You can fetch both these details in the audit event logs : User creation and Last Logon Time. You can forward these logs to AWS cloudwatch and then get these pulled using the boto3 APIs.

Since I am not very familiar with boto3 APIs and how to pull the details using them, I would recommend testing around to pull the details from cloudtwatch.

[+] Enabling Amazon CloudWatch Logs log forwarding for AWS Managed Microsoft AD https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_enable_log_forwarding.html

[+] CloudWatch Logs examples using SDK for Python (Boto3) https://docs.aws.amazon.com/code-library/latest/ug/python_3_cloudwatch-logs_code_examples.html