Permissions drift. People leave, programs are replaced, and their keys stay behind. The credential report is the list to audit.
Getting the report
sh
aws iam generate-credential-reportIAM builds the report. Then fetch it:
sh
aws iam get-credential-report --query Content --output text | base64 -dThe report arrives encoded. --query Content --output text keeps only the report, and base64 -d decodes it into a CSV: one line per user, with a column for each fact.
credential report (some columns)
| user | password_enabled | mfa_active | access_key_1_last_used_date |
|---|---|---|---|
| admin | true | true | 2026-10-20T02:09:06+00:00 |
| sam | true | false | N/A |
| legacy-bot | false | false | N/A |
Three findings to look for:
| Finding | Action |
|---|---|
| a person with a password and no MFA | get MFA on (the next lesson enforces it) |
| a key never used, or not used for 90 days | delete it |
| two active keys for months | a key swap that never finished: delete the old key |
Checking one key
sh
aws iam get-access-key-last-used --access-key-id AKIA6KHPQTKJ4XIQ7V7WThe answer names the service and region the key last signed for, or N/A if it never signed anything. list-access-keys shows a user's key ids.
Deleting a key
sh
aws iam delete-access-key --user-name legacy-bot --access-key-id AKIA6KHPQTKJ4XIQ7V7WAnything still using the key breaks at once, which is how you find out it was not unused after all.