The account has two people, mei and tomas, and a backup program, old-backup, with two access keys. The backup still runs every night with one of them.

1. Generate the credential report.

2. Fetch it and decode it:

   sh

   copy

   aws iam get-credential-report --query Content --output text | base64 -d

3. List old-backup's access keys, and find out which one the backup actually uses.

4. Delete the key nothing uses. The backup must keep working.