[IAM] Programmatically list all users with console access enabled

Question

ListUsers only contains 'PasswordLastUsed' which isn't suitable to use for this purpose.

Accepted Answer

A login profile is required for console access, so any IAM user with a login profile has access to the console.

So, using the CLI or API that fits your use case:

1. list-users
2. for each user
3. get-login-profile --user-name 
4. If no login profile then they do not have console access.

Answer

You can find this information in a Credentials Report. See: [Getting credential reports for your AWS account](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html#id_credentials_understanding_the_report_format). You will need to parse the report but the data you are looking for is in there.

[IAM] Programmatically list all users with console access enabled

相關內容